ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE, Data Theft, and Supply-Chain Backdoors (CVE-2026-25253)

ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE (TL-2026-1212), also tracked as ClawHavoc, is a high-severity supply-chain compromise scored CVSS 8.8, first published 2026-07-11. It has no confirmed attribution, affects OpenClaw OpenClaw (formerly Clawdbot, Moltbot) AI agent framework, references 1 CVE (CVE-2026-25253), maps to 31 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-1212

Threat ID
TL-2026-1212
Also known as
ClawHavoc
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-07-11
Last reviewed
2026-07-11
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, cryptocurrency-finance, general-consumer, public-companies
Target regions
Global
Detection rules
9
Indicators of compromise
23

Malware and tooling in ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE

Malware and tooling: AMOS, cluw

ClawHub, the official skill marketplace for the open-source OpenClaw AI agent platform, grew from under 2,000 to over 50,000 skills between January and April 2026 with minimal security review, enabling a documented supply-chain crisis: the ClawHavoc campaign (1,184 malicious skills, 247,000 installs, $2.3M in stolen cryptocurrency via Atomic macOS Stealer), a critical one-click RCE (CVE-2026-25253, CVSS 8.8) exploiting unvalidated gatewayUrl WebSocket token exfiltration, a Python-pickle-deserialization RCE backdoor disguised as a "distributed state recovery tool," and a download-ranking manipulation flaw that let malicious skills auto-install via autonomous agent tool selection.

How ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE works

OpenClaw is an open-source AI agent framework that grants installed "skills" full system permissions — file read/write, network access, and shell command execution — immediately upon installation, with no sandboxing or per-permission scoping. ClawHub, its official skill marketplace, scaled from fewer than 2,000 skills in January 2026 to over 50,000 by April 2026, a 25x expansion in under 90 days, dramatically outpacing any vetting capacity.

This explosive, unvetted growth produced four distinct but related security failures documented across independent researchers between February and June 2026:

1. **ClawHavoc supply-chain campaign**: Beginning around January 2026, threat actors compromised or created developer accounts on ClawHub to publish malicious skills. Koi Security's Oren Yomtov first disclosed 341 malicious skills out of 2,857 scanned on February 1, 2026; a follow-up scan on February 16 found 824 malicious skills in a registry that had grown to 10,700+; Antiy Labs ultimately catalogued 1,184 malicious skills published historically to ClawHub via 12 compromised developer accounts, resulting in 247,000 confirmed installations and $2.3 million in stolen cryptocurrency. Payloads used typosquatted skill names ("Google Assistant Pro," "YouTube Summarize Pro," wallet/Polymarket/YouTube utilities) to deliver the Atomic macOS Stealer (AMOS) trojan, embedded in shell scripts and later pivoted to skill-page comments disguised as "update service" instructions after SKILL.md-focused scanning caught the initial vector.

2. **CVE-2026-25253 — one-click RCE via auth-token exfiltration**: OpenClaw's Control UI (affecting all versions before 2026.1.29) reads a `gatewayUrl` value from a query string and automatically establishes a WebSocket connection without user confirmation, transmitting the operator's authentication token to whatever host the URL specifies. Because OpenClaw operates with full file/shell access, token theft grants an attacker complete control of the victim's machine with a single malicious link click. Public disclosure was February 3, 2026; contemporaneous internet-wide scanning found over 40,000 exposed OpenClaw instances, 63% assessed as remotely exploitable. The vendor's initial fix (2026.1.29) added a confirmation prompt when gatewayUrl changes.

3. **Pickle-deserialization RCE backdoor**: A skill masquerading as a "distributed state recovery tool," complete with legitimate-looking architecture documentation, fetched a remote payload from attacker C2, decoded it through a chained 12-method encoding scheme (Base64, ROT13, Morse, and others), and executed it via unsafe Python `pickle.loads()` deserialization. Tencent's Zhuque Lab AIG platform flagged the combination of remote fetch, chained encoding, and unsafe deserialization as the detection signature; the skill's declared networking/Python-runtime permissions appeared superficially legitimate for its stated purpose.

4. **Download-ranking manipulation → autonomous auto-install**: Silverfort researchers found an unauthenticated, unrate-limited public RPC endpoint (`download.increment`) that let any attacker with a skill ID and deployment URL arbitrarily inflate a skill's download count. Using a proof-of-concept "Outlook Graph Integration" skill with a hidden data-exfiltration payload (collecting the victim's username and FQDN to an attacker-controlled server), the researchers drove the skill to the #1 ranking in its category, producing 3,900 autonomous executions within 6 days across 50+ cities, including at several public companies — because OpenClaw agents autonomously prioritize installing the highest-ranked skill when selecting tools. Reported March 16, 2026; ClawHub shipped a fix within ~24 hours.

Broader corpus analysis by Tencent Zhuque Lab (scanning ~50,000 skills) found 74.6% declare network-request permissions and roughly 25% have file read/write capability, with 246,378 distinct external URLs (29,196 unique domains) referenced across skill code, several overlapping with known C2 infrastructure. A 15,427-developer base is heavily concentrated: the top 20 developers account for 5,422 skills (12.9% of the corpus), and one account alone published 955 skills in 90 days — a pattern consistent with automated batch-generation rather than organic development, strongly correlated with the malicious clusters. Shanghai Jiao Tong University's SkillProbe team independently found over 90% of highly-downloaded skills failed rigorous security audits. Following disclosure, ClawHub integrated VirusTotal screening (Feb 2026) and partnered with NVIDIA for tooling/documentation analysis (June 1, 2026), though Unit 42 documented at least five distinct malicious skills evading these controls between February and May 2026 via 22MB README padding (exceeding scanner size thresholds), paste-site redirect indirection (allowing payload updates without republishing), and runtime affiliate-link/front-running injection schemes.

MITRE ATT&CK techniques used in TL-2026-1212

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell; T1059.006 Python; T1203 Exploitation for Client Execution; T1204.001 Malicious Link

Command and Control

T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer; T1205.002 Socket Filters; T1571 Non-Standard Port

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Initial Access

T1195 Supply Chain Compromise; T1199 Trusted Relationship; T1566 Phishing

stealth

T1211 Exploitation for Stealth

Credential Access

T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files

Persistence

T1547.013 XDG Autostart Entries

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Resource Development

T1583.001 Domains; T1586 Compromise Accounts

Impact

T1657 Financial Theft

Affected products and versions in ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE

  • OpenClaw — OpenClaw (formerly Clawdbot, Moltbot) AI agent framework
    Vulnerable versions: all versions before 2026.1.29
    Fixed in: 2026.1.29 and later
  • OpenClaw — ClawHub skill marketplace
    Vulnerable versions: marketplace platform prior to March 2026 ranking-endpoint patch and Feb 2026 VirusTotal integration
    Fixed in: post-March 2026 hardened download-increment endpoint; VirusTotal screening added Feb 2026 (bypassed by subsequent evasive skills through May 2026)

Remediation for ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE

Patches

  • OpenClaw 2026.1.29 — adds confirmation prompt before establishing WebSocket connection on gatewayUrl change (CVE-2026-25253)
  • ClawHub backend patch (March 2026, within ~24 hours of Silverfort disclosure) — closed unauthenticated download.increment RPC endpoint

Immediate actions

  • Upgrade OpenClaw to version 2026.1.29 or later to remediate CVE-2026-25253 gatewayUrl token exfiltration
  • Audit all currently installed ClawHub skills for excessive permission grants relative to stated function
  • Remove/quarantine skills published by accounts with unusually high publication velocity (>200 skills or >10 skills/day)
  • Block known malicious C2 domains and IPs at DNS/perimeter (2.26.75[.]16, 91.92.242[.]30, laosji[.]net, letssendit[.]fun, rentry[.]co/openclaw-code, glot[.]io/snippets/hfd3x9ueu5)
  • Restrict/disable automatic WebSocket connection on gatewayUrl query-string values in the Control UI until patched

Workarounds

  • Do not click untrusted OpenClaw Control UI links containing a gatewayUrl query parameter
  • Manually curate skill installs rather than relying on autonomous agent tool-selection/ranking behavior
  • Restrict OpenClaw agent shell/Bash and sensitive file access via host-level controls until per-skill sandboxing is available

Longer-term hardening

  • Implement per-skill permission sandboxing (file, network, shell) rather than full-system grants on install
  • Adopt supply-chain vetting: line-by-line SKILL.md review, cross-reference declared permissions against documented functionality
  • Deploy outbound network monitoring for undocumented endpoints referenced by installed skills
  • Enforce content-analysis scanning thresholds that cannot be bypassed via oversized documentation/README padding
  • Rate-limit and authenticate all marketplace backend RPC endpoints, especially those affecting ranking/visibility (e.g., download counters)
  • Cap the number of concurrently active/installed skills per agent deployment

CVEs associated with ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE

CVE-2026-25253

Weaknesses (CWE) in ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE

CWE-669, CWE-502, CWE-306

Timeline of ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE

  • ClawHavoc campaign begins; threat actors compromise/create 12 ClawHub developer accounts to publish malicious skills distributing Atomic macOS Stealer (AMOS) via typosquatted utility names.
  • ClawHub integrates VirusTotal screening into its skill-submission pipeline following the ClawHavoc disclosures.
  • CVE-2026-25253 (OpenClaw gatewayUrl one-click RCE via auth-token exfiltration, CVSS 8.8) publicly disclosed via GitHub Security Advisory GHSA-g8p2-7wf7-98mq; Koi Security's Oren Yomtov separately discloses 341 malicious ClawHub skills out of 2,857 scanned.
  • Internet-wide scanning finds over 40,000 exposed OpenClaw instances, with 63% assessed as remotely exploitable for CVE-2026-25253.
  • Follow-up ClawHub scan finds 824 malicious skills in a registry that has grown to 10,700+ skills; Antiy Labs later catalogues 1,184 malicious skills historically published, tied to 247,000 installations and $2.3M in stolen cryptocurrency.
  • Silverfort discloses an unauthenticated public RPC endpoint (download.increment) enabling arbitrary download-count inflation; PoC 'Outlook Graph Integration' skill reaches #1 ranking, is auto-installed 3,900 times across 50+ cities within 6 days via autonomous agent tool selection.
  • ClawHub ships a fix within roughly 24 hours of Silverfort's disclosure, closing the exposed download-increment path.
  • Tencent Zhuque Lab publishes a scan of ~50,000 ClawHub skills, finding 74.6% declare network permissions, ~25% have file read/write access, and documenting the pickle-deserialization 'distributed state recovery tool' RCE backdoor.
  • Unit 42 documents the 'omnicogg' skill using 22MB README padding to bypass ClawScan/VirusTotal size thresholds while distributing AMOS malware, remaining active despite prior scanning integration.
  • ClawHub partners with NVIDIA for enhanced documentation and tool-analysis capabilities in response to ongoing supply-chain abuse.
  • CVE-2026-25253 record last modified in NVD, reflecting continued tracking of the vulnerability's disclosure and remediation status.
  • Palo Alto Networks Unit 42 publishes a comprehensive analysis of five distinct malicious OpenClaw skills active Feb-May 2026, detailing infostealer, affiliate-injection, and front-running attack chains with full IOC set.
  • Cyber Security News publishes consolidated coverage of ClawHub's RCE, data-theft, and ranking-manipulation exposure, cited as the hunt source for this threat record.

Sources cited for ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE

Threats related to ClawHub Marketplace Skills Expose OpenClaw AI Agents to RCE

Detection coverage for TL-2026-1212

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1212 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-1212

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats