Malicious OpenClaw Skills — AMOS macOS Stealer Supply Chain via ClawHub, SkillsMP, and GitHub
Malicious OpenClaw Skills (TL-2026-0136), also tracked as AMOS, is a critical-severity supply-chain compromise, first published 2026-02-24. It is attributed to AMOS Operators (Russia) with low confidence, affects Apple macOS, maps to 25 MITRE ATT&CK techniques (T1005, T1027.013, T1036.005), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-0136
- Threat ID
- TL-2026-0136
- Also known as
- AMOS, Atomic macOS Stealer, Trojan.MacOS.Amos, ClawHavoc
- Severity
- CRITICAL
- Status
- MONITORING
- Category
- SUPPLY_CHAIN
- First published
- 2026-02-24
- Last reviewed
- 2026-02-24
- Attribution
- AMOS Operators
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, cryptocurrency, developer, enterprise, financial
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in Malicious OpenClaw Skills
Malware and tooling: AMOS
Trend Micro identified 39 malicious OpenClaw skills on ClawHub (related to 341+ ClawHavoc skills, 2,200+ on GitHub) distributing a new Atomic macOS Stealer (AMOS) variant. The campaign exploits AI agentic workflows by embedding malicious instructions in SKILL.md files that trick AI agents into presenting fake CLI installation dialogs, socially engineering users into entering passwords. The AMOS variant exfiltrates Apple Keychain, KeePass credentials, browser data from 19 browsers, 150+ crypto wallets, and user documents via Base64-encoded curl payloads to attacker C2 infrastructure.
How Malicious OpenClaw Skills works
Trend Micro TrendAI Research discovered a critical evolution in Atomic macOS Stealer (AMOS) distribution — a supply chain attack that manipulates AI agentic workflows on OpenClaw. This campaign represents a paradigm shift from traditional social engineering of humans to "social engineering" of AI agents, using the AI itself as a trusted intermediary to trick users into installing malware.
The infection chain begins with malicious SKILL.md files uploaded to skill repositories (ClawHub, SkillsMP, skills.sh, GitHub). These files contain seemingly harmless prerequisite installation instructions directing the AI agent to visit openclawcli[.]vercel[.]app — a fake CLI tool website. The agent fetches the installation instructions and, depending on the LLM model used, either silently executes or persistently prompts the user to install the "driver." Notably, Claude Opus 4.5 identified the trick and refused to proceed, while GPT-4o either silently installed or repeatedly prompted the user.
The malicious website serves a Base64-encoded payload that decodes to a curl command fetching a Mach-O universal binary from 91.92.242[.]30. The binary runs on both Intel and Apple Silicon Macs, is signed with an ad-hoc signature (no registered developer), and was rejected by macOS security assessment. However, if the user proceeds past warnings, a fake dialogue box captures the user's password, followed by a Finder control permission request.
The AMOS variant harvests: (1) Apple Keychain credentials — passwords, certificates, private keys; (2) KeePass vault files (.kdbx); (3) User files from Desktop/Documents/Downloads (*.txt, *.md, *.csv, *.json, *.doc, *.docx, *.xls, *.xlsx, *.pdf, *.cfg); (4) Apple Notes; (5) Browser data from 19 browsers — cookies, passwords, autofill, credit cards; (6) 150+ cryptocurrency wallet extensions and 17 desktop wallets; (7) Telegram and Discord messages; (8) System info — software version, hardware version, display config. Notably, .env files (common LLM API key stores) are NOT exfiltrated.
All strings within the binary use multi-key XOR encryption with 6 master keys initialized at startup. The encryption uses tiered schemes based on string length (8/16/32/48 bytes). Data is compressed to ZIP and exfiltrated via HTTP POST to socifiapp[.]com/api/reports/upload with user_id and build_tag parameters.
Post-exfiltration, the malware can download and install backdoored versions of Ledger Live and Trezor Suite cryptocurrency wallet applications, enabling ongoing financial theft.
The campaign scope is massive: 39 identified malicious skills on ClawHub (all taken down but code remains on GitHub), 341 ClawHavoc skills identified by Koi Research, and over 2,200 malicious skills on GitHub. Skill authors include thiagoruss0 (majority), stveenli, and heldinhow. The skills span diverse categories (coding agents, SEO optimizers, web search, social media, finance news, transcription) with no specific focus pattern, maximizing potential victim exposure.
This AMOS variant lacks system persistence mechanisms and does not target .env files, distinguishing it from previous AMOS campaigns. It represents the evolution from "ClickFix" lures → cracked Mac software → poisoned GEO (ChatGPT/Grok, per Huntress) → malicious AI agent skills.
MITRE ATT&CK techniques used in TL-2026-0136
collection
T1005 Data from Local System; T1056.002 GUI Input Capture; T1213 Data from Information Repositories; T1560.001 Archive via Utility
defense-evasion
T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204.002 Malicious File
command-and-control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer
discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1518.001 Security Software Discovery
initial-access
T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
credential-access
T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers
defense-impairment
T1553.002 Code Signing; T1685 Disable or Modify Tools
exfiltration
T1567 Exfiltration Over Web Service
impact
Affected products and versions in Malicious OpenClaw Skills
- Apple — macOS
Vulnerable versions: All versions (Intel and Apple Silicon)
Fixed in: Protected by Gatekeeper if enforced - OpenClaw — OpenClaw Skills Platform
Vulnerable versions: All versions consuming unverified skills
Fixed in: Skills taken down from ClawHub
Remediation for Malicious OpenClaw Skills
Immediate actions
- Block domains: openclawcli[.]vercel[.]app, socifiapp[.]com, install.app-distribution[.]net
- Block IP 91.92.242[.]30 at network perimeter
- Audit all installed OpenClaw skills against IOC list — remove any matching malicious skills
- Scan for known AMOS SHA256 hashes on all macOS endpoints
- Check for unauthorized Finder control permissions in macOS Privacy settings
- Rotate all credentials stored in Apple Keychain on affected systems
Workarounds
- Review SKILL.md content manually before installing any OpenClaw skill
- Look for red flags: external URL prerequisites, base64 -D | bash patterns, vercel.app domains
- Use containers (Docker) for AI agent execution environments
- Disable Allow apps downloaded from: Anywhere in macOS Gatekeeper settings
Longer-term hardening
- Implement skill allowlisting — only install OpenClaw skills from verified publishers
- Run AI agents in containerized environments to contain malicious skill execution
- Deploy EDR/MDR with macOS coverage (TrendAI Vision One, CrowdStrike Falcon, etc.)
- Monitor for Base64-encoded curl payloads in SKILL.md files before installation
- Use advanced LLM models (Claude Opus 4.5+) that detect and refuse suspicious installation requests
- Block ad-hoc signed Mach-O binaries via macOS security policy
Weaknesses (CWE) in Malicious OpenClaw Skills
CWE-494, CWE-829
Timeline of Malicious OpenClaw Skills
- Trend Micro publishes MDR analysis of AMOS Stealer campaign — distributed via cracked macOS software. Source: https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html
- openclawcli[.]vercel[.]app and related infrastructure first observed. Malicious skills begin appearing on ClawHub and GitHub.
- Huntress reports AMOS distributed via poisoned ChatGPT and Grok AI answers — GEO poisoning vector.
- Malicious skills taken down from ClawHub. Code still exists in ClawHub's GitHub repository. 2,200+ malicious skills identified on GitHub.
- OpenSourceMalware publishes report on malicious ClawHub skills hiding in plain sight.
- Koi Research publishes ClawHavoc report — 341 malicious skills identified targeting OpenClaw agents.
- Trend Micro publishes full technical analysis of malicious OpenClaw skills distributing AMOS. 39 ClawHub skills identified. Source: https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html
- Threadlinqs Intelligence Platform publishes TL-2026-0136 with full MITRE mapping, detections, and simulations.
- As of 2026-05-29, the threat remains active: the original 39 ClawHub skills were taken down (CONTAINED) but their code persists on GitHub and the AMOS Operators stay live, with the ClawHavoc operation escalating to 1,184+ skills (~1 in 12) and Microsoft's May 6 2026 blog confirming ongoing AMOS/MacSync/SHub macOS campaigns. The specific cluster is contained while the actor, rotating C2 infrastructure, and broader supply-chain campaign continue (successor TL-2026-0447), warranting MONITORING.
Sources cited for Malicious OpenClaw Skills
- Trend Micro: Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer
- Koi Research: ClawHavoc — 341 Malicious Skills Found
- Trend Micro: What OpenClaw Reveals About Agentic Assistants
- OpenSourceMalware: Malicious ClawHub Skills Hide in Plain Sight
- Trend Micro: AMOS Stealer MDR Analysis (Sep 2025)
- Huntress: AMOS Stealer via Poisoned ChatGPT and Grok Answers
- Trend Micro IOC File — SHA256 hashes, domains, URLs, skill names
- TrendAI Vision One — AMOS threat intelligence and hunting queries
- Trend Micro: Using Containers to Secure MCP Infrastructure
- VirusTotal — il24xgriequcys45 Mach-O binary (26 detections)
Threats related to Malicious OpenClaw Skills
- OpenClaw / ClawHub AI Skill Marketplace Supply-Chain Compromise — Malicious Skills cluw, AMOS, omnicogg, money-radar, letssendit
- Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply Chain (AMOS, cluw, Solana Front-Running)
- AI Supply Chain Abuse — 575 Trojanized OpenClaw/ClawHub Skills + Hugging Face Malware Staging (Acronis TRU)
Detection coverage for TL-2026-0136
As of 2026-02-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0136 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.