# OpenClaw AI Agent Skills Weaponized on ClawHub (ClawHavoc) to Deliver Atomic Stealer, Trojans and Backdoors

> Hundreds of malicious OpenClaw (formerly Clawdbot/Moltbot) agent skills were published to the ClawHub marketplace, led by the publisher "hightower6eu", using fake 'Prerequisites' to trick users into installing Atomic macOS Stealer (AMOS) on macOS and packed trojans on Windows. Koi Security tracks the main campaign as ClawHavoc.

- **Published:** 2026-10-20T06:58:24Z
- **Last reviewed:** 2026-10-20T06:58:24Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3938
- **ID:** TL-2026-3938
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between 27 January and early February 2026, threat actors uploaded large numbers of poisoned skills to ClawHub, the official skills marketplace for the OpenClaw AI agent framework. Skills were disguised as popular utilities: cryptocurrency wallets and trackers, Polymarket and Bybit trading bots, Yahoo Finance and finance tracking tools, YouTube summarizers/downloaders, Google Workspace integrations, auto-updaters, social media analysis tools and ClawHub typosquats (e.g. clawhubb, clawwhub). Koi Security audited 2,857 skills and found 341 malicious, 335 of them tied to one coordinated operation it named ClawHavoc; VirusTotal Code Insight analyzed 3,016 skills and found hundreds with malicious characteristics, attributing 314 at the time of its report to the single ClawHub user hightower6eu (count still growing). Later analysis by Antiy attributes 677 malicious skills to hightower6eu and 390 to a second account, sakaen736jih, and reports 1,184 malicious packages in ClawHub's historical repository (60 packages with 14,285 downloads); PolySwarm reports over 900 malicious skills. Counts differ by source and date.

The infection chain is social-engineering based rather than a software vulnerability. The SKILL.md documentation contains a fake 'Prerequisites' section instructing the user (or the agent acting for them) to install a helper component. On Windows the instruction is to download a password-protected ZIP (e.g. openclaw-agent.zip, password 'openclaw') from an attacker-controlled GitHub account and run the executable inside, a packed trojan per VirusTotal; the trojanized installers are reported to include keylogging. On macOS the user is told to paste a Base64-obfuscated shell command, sourced from script-sharing sites such as glot.io (and rentry.co per PolySwarm), into Terminal; this fetches a second stage over plain HTTP from 91.92.242.30 and drops a Mach-O Atomic Stealer variant. Koi reports that all of the skills it analyzed share the C2 91.92.242.30.

AMOS is a commodity malware-as-a-service stealer (about $500-$1,000 per month). In this campaign it used runtime string decryption, fake password prompts to harvest the macOS login password, recursive directory copying and exfiltration of compressed archives to C2. Targets include browser profiles and saved credentials, Keychain, 60+ crypto wallets, Telegram data, SSH keys, shell history and documents. Because the victims run AI agents, the stolen data also covers API keys, exchange keys and tokens held by the agent. Some skills instead hid reverse shell backdoors inside otherwise functional code, or exfiltrated bot credentials from ~/.clawdbot/.env to webhook.site. Follow-on activity used deceptive comments under popular ClawHub skills to direct users to malicious downloads.

Timeline: first malicious skill (polymarket-trading-bot v1.0.1) appeared 27 January 2026, a mass upload occurred on 31 January, Koi disclosed publicly on 1 February, VirusTotal published its analysis on 2 February, and platform cleanup began 3-4 February. OpenClaw's creator added a reporting feature in which skills with more than 3 unique reports are auto-hidden. No CVE or CVSS applies; severity is analyst-assigned. Attribution is unresolved; no named actor is established, and one search summary attributes it to actors of potentially Chinese origin with low confidence.

## MITRE ATT&CK

- T1583.006 Web Services
- T1608.001 Upload Malware
- T1195.002 Compromise Software Supply Chain
- T1204.004 Malicious Copy and Paste
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1555.001 Keychain
- T1552.001 Credentials In Files
- T1056.002 GUI Input Capture
- T1056.001 Keylogging
- T1071.001 Web Protocols

## Sources

- [From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized](https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html)
- [ClawHavoc: 341 Malicious Clawed Skills Found by the Bot They Were Targeting (Koi Security)](https://koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting)
- [ClawHavoc: Analysis of Large-Scale Poisoning Campaign Targeting the OpenClaw Skill Market for AI Agents (Antiy)](https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/)
- [The ClawHavoc Campaign (PolySwarm)](https://blog.polyswarm.io/the-clawhavoc-campaign)
- [Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users (The Hacker News)](https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html)
- [Hundreds of Malicious Skills Found in OpenClaw's ClawHub (eSecurityPlanet)](https://esecurityplanet.com/threats/hundreds-of-malicious-skills-found-in-openclaws-clawhub)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3938