Malicious OpenClaw Skills — AMOS macOS Stealer Supply Chain via ClawHub, SkillsMP, and GitHub — Threadlinqs Intelligence
As of 2026-05-30, Malicious OpenClaw Skills — AMOS macOS Stealer Supply Chain via ClawHub, SkillsMP, and GitHub is a critical-severity supply chain threat attributed to AMOS Operators (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0136 · Severity: CRITICAL · Status: MONITORING · Category: SUPPLY_CHAIN
Attribution: AMOS Operators · Russia · FINANCIAL
Trend Micro identified 39 malicious OpenClaw skills on ClawHub (related to 341+ ClawHavoc skills, 2,200+ on GitHub) distributing a new Atomic macOS Stealer (AMOS) variant. The campaign exploits AI
Trend Micro TrendAI Research discovered a critical evolution in Atomic macOS Stealer (AMOS) distribution — a supply chain attack that manipulates AI agentic workflows on OpenClaw. This campaign represents a paradigm shift from traditional social engineering of humans to "social engineering" of AI agents, using the AI itself as a trusted intermediary to trick users into installing malware.
The infection chain begins with malicious SKILL.md files uploaded to skill repositories (ClawHub, SkillsMP, skills.sh, GitHub). These files contain seemingly harmless prerequisite installation instructions directing the AI agent to visit openclawcli[.]vercel[.]app — a fake CLI tool website. The agent fetches the installation instructions and, depending on the LLM model used, either silently executes or persistently prompts the user to install the "driver." Notably, Claude Opus 4.5 identified the trick and refused to proceed, while GPT-4o either silently installed or repeatedly prompted the user.
The malicious website serves a Base64-encoded payload that decodes to a curl command fetching a Mach-O universal binary from 91.92.242[.]30. The binary runs on both Intel and Apple Silicon Macs, is signed with an ad-hoc signature (no registered developer), and was rejected by macOS security assessment. However, if the user proceeds past warnings, a fake dialogue box captures the user's password, followed by a Finder control permission request.
The AMOS variant harvests: (1) Apple Keychain credentials — passwords, certificates, private keys; (2) KeePass vault files (.kdbx); (3) User files from Desktop/Documents/Downloads (*.txt, *.md, *.csv, *.json, *.doc, *.docx, *.xls, *.xlsx, *.pdf, *.cfg); (4) Apple Notes; (5) Browser data from 19 browsers — cookies, passwords, autofill, credit cards; (6) 150+ cryptocurrency wallet extensions and 17 desktop wallets; (7) Telegram and Discord messages; (8) System info — software version, hardware version, display config. Notably, .env files (common LLM API key stores) are NOT exfiltrated.
All strings within the binary use multi-key XOR encryption with 6 master keys initialized at startup. The encryption uses tiered schemes based on string length (8/16/32/48 bytes). Data is compressed to ZIP and exfiltrated via HTTP POST to socifiapp[.]com/api/reports/upload with user_id and build_tag parameters.
Post-exfiltration, the malware can download and install backdoored versions of Ledger Live and Trezor Suite cryptocurrency wallet applications, enabling ongoing financial theft.
The campaign scope is massive: 39 identified malicious skills on ClawHub (all taken down but code remains on GitHub), 341 ClawHavoc skills identified by Koi Research, and over 2,200 malicious skills on GitHub. Skill authors include thiagoruss0 (majority), stveenli, and heldinhow. The skills span diverse categories (coding agents, SEO optimizers, web search, social media, finance news, transcription) with no specific focus pattern, maximizing potential victim exposure.
This AMOS variant lacks system persistence mechanisms and does not target .env files, distinguishing it from previous AMOS campaigns. It represents the evolution from "ClickFix" lures → cracked Mac software → poisoned GEO (ChatGPT/Grok, per Huntress) → malicious AI agent skills.
Weaknesses (CWE)
CWE-494, CWE-829
Target sectors: technology, cryptocurrency, developer, enterprise, financial
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195.002, T1199, T1204.002, T1059.004, T1059.002, T1027.013, T1036.005, T1553.002, T1562.001, T1140