# Malicious OpenClaw Skills — AMOS macOS Stealer Supply Chain via ClawHub, SkillsMP, and GitHub

> Trend Micro identified 39 malicious OpenClaw skills on ClawHub (related to 341+ ClawHavoc skills, 2,200+ on GitHub) distributing a new Atomic macOS Stealer (AMOS) variant. The campaign exploits AI agentic workflows by embedding malicious instructions in SKILL.md files that trick AI agents into presenting fake CLI installation dialogs, socially engineering users into entering passwords. The AMOS variant exfiltrates Apple Keychain, KeePass credentials, browser data from 19 browsers, 150+ crypto wallets, and user documents via Base64-encoded curl payloads to attacker C2 infrastructure.

- **Published:** 2026-02-24T06:33:00Z
- **Last reviewed:** 2026-02-24T06:33:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0136
- **ID:** TL-2026-0136
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** MONITORING
- **Actor:** AMOS Operators (Russia)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Trend Micro TrendAI Research discovered a critical evolution in Atomic macOS Stealer (AMOS) distribution — a supply chain attack that manipulates AI agentic workflows on OpenClaw. This campaign represents a paradigm shift from traditional social engineering of humans to "social engineering" of AI agents, using the AI itself as a trusted intermediary to trick users into installing malware.

The infection chain begins with malicious SKILL.md files uploaded to skill repositories (ClawHub, SkillsMP, skills.sh, GitHub). These files contain seemingly harmless prerequisite installation instructions directing the AI agent to visit openclawcli[.]vercel[.]app — a fake CLI tool website. The agent fetches the installation instructions and, depending on the LLM model used, either silently executes or persistently prompts the user to install the "driver." Notably, Claude Opus 4.5 identified the trick and refused to proceed, while GPT-4o either silently installed or repeatedly prompted the user.

The malicious website serves a Base64-encoded payload that decodes to a curl command fetching a Mach-O universal binary from 91.92.242[.]30. The binary runs on both Intel and Apple Silicon Macs, is signed with an ad-hoc signature (no registered developer), and was rejected by macOS security assessment. However, if the user proceeds past warnings, a fake dialogue box captures the user's password, followed by a Finder control permission request.

The AMOS variant harvests: (1) Apple Keychain credentials — passwords, certificates, private keys; (2) KeePass vault files (.kdbx); (3) User files from Desktop/Documents/Downloads (*.txt, *.md, *.csv, *.json, *.doc, *.docx, *.xls, *.xlsx, *.pdf, *.cfg); (4) Apple Notes; (5) Browser data from 19 browsers — cookies, passwords, autofill, credit cards; (6) 150+ cryptocurrency wallet extensions and 17 desktop wallets; (7) Telegram and Discord messages; (8) System info — software version, hardware version, display config. Notably, .env files (common LLM API key stores) are NOT exfiltrated.

All strings within the binary use multi-key XOR encryption with 6 master keys initialized at startup. The encryption uses tiered schemes based on string length (8/16/32/48 bytes). Data is compressed to ZIP and exfiltrated via HTTP POST to socifiapp[.]com/api/reports/upload with user_id and build_tag parameters.

Post-exfiltration, the malware can download and install backdoored versions of Ledger Live and Trezor Suite cryptocurrency wallet applications, enabling ongoing financial theft.

The campaign scope is massive: 39 identified malicious skills on ClawHub (all taken down but code remains on GitHub), 341 ClawHavoc skills identified by Koi Research, and over 2,200 malicious skills on GitHub. Skill authors include thiagoruss0 (majority), stveenli, and heldinhow. The skills span diverse categories (coding agents, SEO optimizers, web search, social media, finance news, transcription) with no specific focus pattern, maximizing potential victim exposure.

This AMOS variant lacks system persistence mechanisms and does not target .env files, distinguishing it from previous AMOS campaigns. It represents the evolution from "ClickFix" lures → cracked Mac software → poisoned GEO (ChatGPT/Grok, per Huntress) → malicious AI agent skills.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1027.013 Encrypted/Encoded File
- T1036.005 Match Legitimate Resource Name or Location
- T1553.002 Code Signing
- T1685 Disable or Modify Tools
- T1140 Deobfuscate/Decode Files or Information
- T1555.001 Keychain
- T1555.005 Password Managers
- T1555.003 Credentials from Web Browsers
- T1056.002 GUI Input Capture
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1213 Data from Information Repositories
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Trend Micro: Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer](https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html)
- [Koi Research: ClawHavoc — 341 Malicious Skills Found](https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting)
- [Trend Micro: What OpenClaw Reveals About Agentic Assistants](https://www.trendmicro.com/en_us/research/26/b/what-openclaw-reveals-about-agentic-assistants.html)
- [OpenSourceMalware: Malicious ClawHub Skills Hide in Plain Sight](https://opensourcemalware.com/blog/malicious-clawhub-skills-hide-in-plain-sight)
- [Trend Micro: AMOS Stealer MDR Analysis (Sep 2025)](https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html)
- [Huntress: AMOS Stealer via Poisoned ChatGPT and Grok Answers](https://www.huntress.com/blog/amos-stealer-chatgpt-grok-ai-trust)
- [Trend Micro IOC File — SHA256 hashes, domains, URLs, skill names](https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/b/amos-stealer-openclaw/ioc-malicious-openclaw-skills-used-to-distribute-atomic-macos-stealer.txt)
- [TrendAI Vision One — AMOS threat intelligence and hunting queries](https://portal.xdr.trendmicro.com/index.html#/app/ti/intelligence_insights)
- [Trend Micro: Using Containers to Secure MCP Infrastructure](https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/using-containers-to-secure-your-mcp-infrastructure)
- [VirusTotal — il24xgriequcys45 Mach-O binary (26 detections)](https://www.virustotal.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0136