OpenClaw / ClawHub AI Skill Marketplace Supply-Chain Compromise — Malicious Skills cluw, AMOS, omnicogg, money-radar, letssendit
OpenClaw / ClawHub AI Skill Marketplace Supply-Chain (TL-2026-0921), also tracked as ClawHavoc-related campaign, is a high-severity supply-chain compromise, first published 2026-06-23. It has no confirmed attribution, affects OpenClaw OpenClaw AI Agent, maps to 23 MITRE ATT&CK techniques (T1005, T1027.001, T1041), and is covered by 9 detection rules and 27 indicators of compromise.
Key facts for TL-2026-0921
- Threat ID
- TL-2026-0921
- Also known as
- ClawHavoc-related campaign, OpenClaw skill marketplace abuse
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-23
- Last reviewed
- 2026-06-23
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cryptocurrency, financial
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 27
Malware and tooling in OpenClaw / ClawHub AI Skill Marketplace Supply-Chain
Malware and tooling: AMOS, cluw, letssendit, money-radar, omnicogg
Unit 42 identified five persistently-malicious third-party skills on the ClawHub marketplace consumed by the OpenClaw AI agent between February and May 2026. The skills span macOS infostealers (cluw, AMOS/Atomic macOS Stealer), 22 MB file-padding scanner evasion (omnicogg), runtime affiliate injection abusing the agent's advisory authority (money-radar), and an agentic Solana/pump.fun front-running pump-and-dump scheme (letssendit), all bypassing ClawScan code analysis and VirusTotal screening.
How OpenClaw / ClawHub AI Skill Marketplace Supply-Chain works
Between February and May 2026, Unit 42 (Palo Alto Networks) tracked sustained malicious activity on ClawHub, the third-party skill marketplace consumed by the OpenClaw AI agent. Unlike conventional memory-corruption supply-chain attacks, these skills weaponize the agent's natural-language interpretation layer — 'semantic instruction hijacking' — to bypass runtime constraints and reach the host file system, shells, and credential managers without any conventional exploit or CVE.
Five representative malicious skills were documented. cluw (SHA256 818aea61...) and AMOS (881ce5cb...) are macOS infostealers; AMOS corresponds to the well-known Atomic macOS Stealer family, confirmed earlier by Trend Micro as distributed through this ecosystem. Both stage Base64-encoded payloads behind paste-site redirect lures (rentry.co/openclaw-code, glot.io/snippets/hfd3x9ueu5) and exfiltrate stolen browser credentials, cookies, and keychain material to dedicated C2 servers (2.26.75.16/Xuvewuyur for cluw; 91.92.242.30 for AMOS).
omnicogg (b30eaed1...) is a Base64 curl-pipe-bash dropper that pads its README.md with ~22 MB of filler characters to exceed scanner processing thresholds — a defense-evasion technique disclosed by JFrog Security in March 2026 — and pulls its second stage from 91.92.242.30/lamq4. money-radar (ebb73dbb...) implements runtime agentic affiliate injection: on each invocation it fetches a referrals.json from the known-malicious domain laosji.net (which has paste-jacking history) and silently rewrites all of the agent's financial recommendations through operator-controlled affiliate links, giving the operator post-installation control without republishing the skill. letssendit (f4e41aa2...) coordinates AI agents to pool victim cryptocurrency into operator wallets and front-run / pump-and-dump meme-token launches on pump.fun, with control infrastructure at letssendit.fun.
The campaign persisted despite ClawHub's VirusTotal partnership and ClawScan static analysis, exploiting indirect payload hosting (paste sites and third-party code-snippet hosts) that lets operators update payloads dynamically without modifying the published skill. Earlier ecosystem reporting set the context: Bitdefender Labs measured ~17% of early OpenClaw skills as malicious, Koi Security's 'ClawHavoc' disclosure enumerated 341 malicious skills, and observed delivery patterns included platform-specific droppers, auto-updater skills with scheduled cron persistence, Telegram Bot API exfiltration, and registry-saturation by single accounts. All five skills were reported to ClawHub for takedown; OpenClaw banned the associated accounts and deleted the skills, then announced a NVIDIA partnership (June 1, 2026) for enhanced skill screening. No CVE or CVSS was assigned by the source — this is a marketplace trust/abuse compromise, not a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-0921
Collection
T1005 Data from Local System; T1119 Automated Collection
Defense Evasion
T1027.001 Binary Padding; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Persistence
Execution
T1059.004 Unix Shell; T1204.001 Malicious Link; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1571 Non-Standard Port
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555 Credentials from Password Stores
defense-impairment
Resource Development
T1583.006 Web Services; T1586 Compromise Accounts; T1608.001 Upload Malware
Impact
Affected products and versions in OpenClaw / ClawHub AI Skill Marketplace Supply-Chain
- OpenClaw — OpenClaw AI Agent
Vulnerable versions: all versions consuming third-party ClawHub skills - OpenClaw / ClawHub — ClawHub Skill Marketplace
Vulnerable versions: pre-NVIDIA screening (Feb-May 2026)
Fixed in: VirusTotal + ClawScan + NVIDIA screening (June 2026) - Apple — macOS (infostealer target platform)
Vulnerable versions: macOS hosts running OpenClaw with cluw/AMOS skills
Remediation for OpenClaw / ClawHub AI Skill Marketplace Supply-Chain
Immediate actions
- Remove the skills cluw, AMOS, omnicogg, money-radar and letssendit from any OpenClaw agent and uninstall all skills from untrusted publishers
- Block the C2 IPs 2.26.75.16 and 91.92.242.30 and the domains laosji.net, letssendit.fun, download.setup-service.com and install.app-distribution.net at the perimeter and DNS layer
- Treat any macOS host that ran cluw or AMOS as compromised: rotate all browser, keychain and cloud credentials and revoke active session cookies
- Block agent fetches to paste/code-snippet hosts used for staging (rentry.co/openclaw-code, glot.io/snippets/hfd3x9ueu5)
Workarounds
- Restrict OpenClaw skill installation to an allow-list of vetted, signed publishers
- Disable agent autonomy over financial recommendations and crypto transactions until skill provenance is verified
Longer-term hardening
- Require publisher provenance verification and line-by-line audit of skill source files before installation
- Monitor outbound network traffic from AI-agent hosts for undocumented endpoints and cross-reference every external connection against the skill's documentation
- Deny AI agents direct shell, credential-manager and arbitrary network egress; sandbox skill execution
- Deploy behavioral EDR (e.g. Cortex XDR/XSIAM) and agentic endpoint security on hosts running AI agents
Weaknesses (CWE) in OpenClaw / ClawHub AI Skill Marketplace Supply-Chain
CWE-506, CWE-829, CWE-494, CWE-1357, CWE-77
Timeline of OpenClaw / ClawHub AI Skill Marketplace Supply-Chain
- Start of the February-May 2026 window in which Unit 42 tracks persistent malicious skills despite VirusTotal partnership integration.
- Trend Micro confirms Atomic macOS Stealer (AMOS) distribution through the OpenClaw skill ecosystem.
- Bitdefender Labs reports ~17% of early OpenClaw skills are malicious; Koi Security's 'ClawHavoc' disclosure enumerates 341 malicious skills.
- JFrog Security discloses the omnicogg 22 MB README.md file-padding technique used to exceed scanner processing thresholds.
- Two TradingView assistant skills carrying the cluw infostealer are published on ClawHub.
- End of the February-May 2026 persistent-activity window documented by Unit 42.
- OpenClaw announces a NVIDIA partnership for enhanced skill documentation and analysis/screening.
- Unit 42 publishes its analysis; all five skills reported to ClawHub for takedown, associated accounts banned and skills deleted.
Sources cited for OpenClaw / ClawHub AI Skill Marketplace Supply-Chain
- OpenClaw's Skill Marketplace and the AI Supply Chain Threat
- Unit 42 — AI supply chain risk analysis (primary report)
- Koi Security — ClawHavoc disclosure (341 malicious skills)
- Bitdefender Labs — ~17% of early OpenClaw skills malicious
- Trend Micro — Atomic macOS Stealer (AMOS) distribution via OpenClaw skills
- JFrog Security — omnicogg 22 MB file-padding scanner evasion
- MITRE ATT&CK — Supply Chain Compromise (T1195.001)
- MITRE ATT&CK — Obfuscated Files or Information: Binary Padding (T1027.001)
Threats related to OpenClaw / ClawHub AI Skill Marketplace Supply-Chain
- Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply Chain (AMOS, cluw, Solana Front-Running)
- ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE, Data Theft, and Supply-Chain Backdoors (CVE-2026-25253)
- AI Supply Chain Abuse — 575 Trojanized OpenClaw/ClawHub Skills + Hugging Face Malware Staging (Acronis TRU)
- Malicious OpenClaw Skills — AMOS macOS Stealer Supply Chain via ClawHub, SkillsMP, and GitHub
- SleeperGem: RubyGems Supply Chain Attack Uses Hijacked Dormant Maintainer Accounts to Weaponize git_credential_manager, Dendreo, and fastlane-plugin-run_tests_firebase_testlab
- AsyncAPI npm Supply Chain Compromise: Import-Time Payload Delivery via Miasma Loader
Detection coverage for TL-2026-0921
As of 2026-06-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0921 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0921
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.