Threat reportSupply ChainTL-2026-3938
OpenClaw AI Agent Skills Weaponized on ClawHub (ClawHavoc) to Deliver Atomic Stealer, Trojans and Backdoors
OpenClaw AI Agent Skills Weaponized on ClawHub (ClawHavoc) (TL-2026-3938), also tracked as ClawHavoc, is a high-severity supply-chain compromise, first published 2026-10-20. It has no confirmed attribution, affects OpenClaw ClawHub skills marketplace and OpenClaw (formerly, maps to 14 MITRE ATT&CK techniques (T1027, T1036, T1056.001), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-3938
- Threat ID
- TL-2026-3938
- Also known as
- ClawHavoc, Trojan/OpenClaw.PolySkill
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, cryptocurrency, software-development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in OpenClaw AI Agent Skills Weaponized on ClawHub (ClawHavoc)
Malware and tooling: AMOS, Atomic Stealer (AMOS), Trojan, Trojan/OpenClaw.PolySkill
How OpenClaw AI Agent Skills Weaponized on ClawHub (ClawHavoc) works
Hundreds of malicious OpenClaw (formerly Clawdbot/Moltbot) agent skills were published to the ClawHub marketplace, led by the publisher "hightower6eu", using fake 'Prerequisites' to trick users into installing Atomic macOS Stealer (AMOS) on macOS and packed trojans on Windows. Koi Security tracks the main campaign as ClawHavoc.
Between 27 January and early February 2026, threat actors uploaded large numbers of poisoned skills to ClawHub, the official skills marketplace for the OpenClaw AI agent framework. Skills were disguised as popular utilities: cryptocurrency wallets and trackers, Polymarket and Bybit trading bots, Yahoo Finance and finance tracking tools, YouTube summarizers/downloaders, Google Workspace integrations, auto-updaters, social media analysis tools and ClawHub typosquats (e.g. clawhubb, clawwhub). Koi Security audited 2,857 skills and found 341 malicious, 335 of them tied to one coordinated operation it named ClawHavoc; VirusTotal Code Insight analyzed 3,016 skills and found hundreds with malicious characteristics, attributing 314 at the time of its report to the single ClawHub user hightower6eu (count still growing). Later analysis by Antiy attributes 677 malicious skills to hightower6eu and 390 to a second account, sakaen736jih, and reports 1,184 malicious packages in ClawHub's historical repository (60 packages with 14,285 downloads); PolySwarm reports over 900 malicious skills. Counts differ by source and date.
The infection chain is social-engineering based rather than a software vulnerability. The SKILL.md documentation contains a fake 'Prerequisites' section instructing the user (or the agent acting for them) to install a helper component. On Windows the instruction is to download a password-protected ZIP (e.g. openclaw-agent.zip, password 'openclaw') from an attacker-controlled GitHub account and run the executable inside, a packed trojan per VirusTotal; the trojanized installers are reported to include keylogging. On macOS the user is told to paste a Base64-obfuscated shell command, sourced from script-sharing sites such as glot.io (and rentry.co per PolySwarm), into Terminal; this fetches a second stage over plain HTTP from 91.92.242.30 and drops a Mach-O Atomic Stealer variant. Koi reports that all of the skills it analyzed share the C2 91.92.242.30.
AMOS is a commodity malware-as-a-service stealer (about $500-$1,000 per month). In this campaign it used runtime string decryption, fake password prompts to harvest the macOS login password, recursive directory copying and exfiltration of compressed archives to C2. Targets include browser profiles and saved credentials, Keychain, 60+ crypto wallets, Telegram data, SSH keys, shell history and documents. Because the victims run AI agents, the stolen data also covers API keys, exchange keys and tokens held by the agent. Some skills instead hid reverse shell backdoors inside otherwise functional code, or exfiltrated bot credentials from ~/.clawdbot/.env to webhook.site. Follow-on activity used deceptive comments under popular ClawHub skills to direct users to malicious downloads.
Timeline: first malicious skill (polymarket-trading-bot v1.0.1) appeared 27 January 2026, a mass upload occurred on 31 January, Koi disclosed publicly on 1 February, VirusTotal published its analysis on 2 February, and platform cleanup began 3-4 February. OpenClaw's creator added a reporting feature in which skills with more than 3 unique reports are auto-hidden. No CVE or CVSS applies; severity is analyst-assigned. Attribution is unresolved; no named actor is established, and one search summary attributes it to actors of potentially Chinese origin with low confidence.
MITRE ATT&CK techniques used in TL-2026-3938
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information
Credential Access
T1056.001 Keylogging; T1056.002 GUI Input Capture; T1552.001 Credentials In Files; T1555.001 Keychain
Execution
T1059.004 Unix Shell; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste
Command and Control
Initial Access
T1195.002 Compromise Software Supply Chain
Resource Development
Affected products and versions in OpenClaw AI Agent Skills Weaponized on ClawHub (ClawHavoc)
- OpenClaw — ClawHub skills marketplace and OpenClaw (formerly Clawdbot/Moltbot) agent users
Vulnerable versions: Skills installed from ClawHub that were published by malicious accounts, including hightower6eu and sakaen736jih - Apple — macOS (targeted by Atomic Stealer payload)
Vulnerable versions: Hosts where the user ran the pasted Terminal command - Microsoft — Windows (targeted by packed trojan payload)
Vulnerable versions: Hosts where the user ran the downloaded executable
Remediation for OpenClaw AI Agent Skills Weaponized on ClawHub (ClawHavoc)
Patches
- No CVE or vendor patch; ClawHub removed identified skills and added a reporting feature that auto-hides skills with more than 3 unique reports
Immediate actions
- Identify and remove any skills published by hightower6eu, sakaen736jih or denboss99 and any skill whose SKILL.md has a 'Prerequisites' step that downloads archives or pipes Base64 commands to a shell
- Block 91.92.242.30, 202.161.50.59, 54.91.154.110 and socifiapp.com at the perimeter and hunt for outbound plain-HTTP connections to them
- Rotate all credentials, API keys, exchange keys, wallet seeds, SSH keys and tokens on hosts where OpenClaw skills were installed, including secrets in ~/.clawdbot/.env
- Hunt for the published SHA-256/MD5 hashes and for Terminal-launched Base64 decode-and-execute activity on macOS
Workarounds
- Do not run commands or binaries that a skill's setup instructions ask you to download or paste into a shell
- Do not extract password-protected archives supplied by a skill
Longer-term hardening
- Run AI agents in sandboxed or ephemeral environments with least-privilege access to credentials and skill folders
- Maintain an allowlist of reviewed skills, disable automatic skill updates and verify integrity before install
- Add outbound network controls and monitoring for agent hosts
- Include AI agent compromise in incident response plans
- Registry operators should add publish-time scanning for malicious patterns
Weaknesses (CWE) in OpenClaw AI Agent Skills Weaponized on ClawHub (ClawHavoc)
Timeline of OpenClaw AI Agent Skills Weaponized on ClawHub (ClawHavoc)
- First malicious skill (polymarket-trading-bot v1.0.1) released on ClawHub (Antiy).
- Additional malicious skills (reddit-trends, base-agent) deployed (Antiy).
- bybit-agent v1.0.0 skill deployed (Antiy).
- Mass upload: 386 malicious skills, including 354 by hightower6eu (Antiy).
- Koi Security publicly discloses ClawHavoc: 341 malicious skills of 2,857 audited, 335 tied to one campaign sharing C2 91.92.242.30.
- OpenClaw creator Peter Steinberger adds reporting: skills with more than 3 unique reports are auto-hidden by default (The Hacker News).
- VirusTotal publishes analysis of 3,016 OpenClaw skills; 314 attributed to hightower6eu; lists AMOS and packed-trojan hashes.
- ClawHub platform cleanup of malicious skills begins (Antiy: 3-4 February).
Sources cited for OpenClaw AI Agent Skills Weaponized on ClawHub (ClawHavoc)
- From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized
- ClawHavoc: 341 Malicious Clawed Skills Found by the Bot They Were Targeting (Koi Security)
- ClawHavoc: Analysis of Large-Scale Poisoning Campaign Targeting the OpenClaw Skill Market for AI Agents (Antiy)
- The ClawHavoc Campaign (PolySwarm)
- Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users (The Hacker News)
- Hundreds of Malicious Skills Found in OpenClaw's ClawHub (eSecurityPlanet)
Detection coverage for TL-2026-3938
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3938 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3938
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.