# OpenClaw / ClawHub AI Skill Marketplace Supply-Chain Compromise — Malicious Skills cluw, AMOS, omnicogg, money-radar, letssendit

> Unit 42 identified five persistently-malicious third-party skills on the ClawHub marketplace consumed by the OpenClaw AI agent between February and May 2026. The skills span macOS infostealers (cluw, AMOS/Atomic macOS Stealer), 22 MB file-padding scanner evasion (omnicogg), runtime affiliate injection abusing the agent's advisory authority (money-radar), and an agentic Solana/pump.fun front-running pump-and-dump scheme (letssendit), all bypassing ClawScan code analysis and VirusTotal screening.

- **Published:** 2026-06-23T00:00:00Z
- **Last reviewed:** 2026-06-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0921
- **ID:** TL-2026-0921
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between February and May 2026, Unit 42 (Palo Alto Networks) tracked sustained malicious activity on ClawHub, the third-party skill marketplace consumed by the OpenClaw AI agent. Unlike conventional memory-corruption supply-chain attacks, these skills weaponize the agent's natural-language interpretation layer — 'semantic instruction hijacking' — to bypass runtime constraints and reach the host file system, shells, and credential managers without any conventional exploit or CVE.

Five representative malicious skills were documented. cluw (SHA256 818aea61...) and AMOS (881ce5cb...) are macOS infostealers; AMOS corresponds to the well-known Atomic macOS Stealer family, confirmed earlier by Trend Micro as distributed through this ecosystem. Both stage Base64-encoded payloads behind paste-site redirect lures (rentry.co/openclaw-code, glot.io/snippets/hfd3x9ueu5) and exfiltrate stolen browser credentials, cookies, and keychain material to dedicated C2 servers (2.26.75.16/Xuvewuyur for cluw; 91.92.242.30 for AMOS).

omnicogg (b30eaed1...) is a Base64 curl-pipe-bash dropper that pads its README.md with ~22 MB of filler characters to exceed scanner processing thresholds — a defense-evasion technique disclosed by JFrog Security in March 2026 — and pulls its second stage from 91.92.242.30/lamq4. money-radar (ebb73dbb...) implements runtime agentic affiliate injection: on each invocation it fetches a referrals.json from the known-malicious domain laosji.net (which has paste-jacking history) and silently rewrites all of the agent's financial recommendations through operator-controlled affiliate links, giving the operator post-installation control without republishing the skill. letssendit (f4e41aa2...) coordinates AI agents to pool victim cryptocurrency into operator wallets and front-run / pump-and-dump meme-token launches on pump.fun, with control infrastructure at letssendit.fun.

The campaign persisted despite ClawHub's VirusTotal partnership and ClawScan static analysis, exploiting indirect payload hosting (paste sites and third-party code-snippet hosts) that lets operators update payloads dynamically without modifying the published skill. Earlier ecosystem reporting set the context: Bitdefender Labs measured ~17% of early OpenClaw skills as malicious, Koi Security's 'ClawHavoc' disclosure enumerated 341 malicious skills, and observed delivery patterns included platform-specific droppers, auto-updater skills with scheduled cron persistence, Telegram Bot API exfiltration, and registry-saturation by single accounts. All five skills were reported to ClawHub for takedown; OpenClaw banned the associated accounts and deleted the skills, then announced a NVIDIA partnership (June 1, 2026) for enhanced skill screening. No CVE or CVSS was assigned by the source — this is a marketplace trust/abuse compromise, not a software vulnerability.

## MITRE ATT&CK

- T1583.006 Web Services
- T1608.001 Upload Malware
- T1586 Compromise Accounts
- T1195.001 Compromise Software Dependencies and Development Tools
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1053.003 Cron
- T1140 Deobfuscate/Decode Files or Information
- T1027.001 Binary Padding
- T1553 Subvert Trust Controls
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [OpenClaw's Skill Marketplace and the AI Supply Chain Threat](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/)
- [MITRE ATT&CK — Supply Chain Compromise (T1195.001)](https://attack.mitre.org/techniques/T1195/001/)
- [MITRE ATT&CK — Obfuscated Files or Information: Binary Padding (T1027.001)](https://attack.mitre.org/techniques/T1027/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0921