Case clawhub-malicious-skillsAI supply chainFeb 4, 2026Worldwide

Over 230 malicious OpenClaw skills on ClawHub push password stealers

Researchers found hundreds of ClawHub skills posing as crypto and social tools that told users to install a fake 'AuthTool', delivering infostealers such as AMOS on macOS.

HighAttack on AIStatus: ContainedVerified case file

Open in the interactive map Cite this case

Reported: Feb 4, 2026
Location: Worldwide
Target: OpenClaw agent users
Severity: High
Triggered by: ClawHavoc operation (unnamed group) plus smaller unrelated uploaders
Actor type: Criminal
Reported loss: None reported
CVE: None

What happened

Researchers found hundreds of ClawHub skills posing as crypto and social tools that told users to install a fake 'AuthTool', delivering infostealers such as AMOS on macOS.

Impact: 341 malicious skills identified, over 100 posing as crypto tools; payloads included AMOS stealer, reverse shells and config exfiltration. Infection counts not confirmed.

Who triggered it

Actor: ClawHavoc operation (unnamed group) plus smaller unrelated uploaders

Attribution: Koi Security linked 335 of 341 malicious skills to a single coordinated operation it calls ClawHavoc; no named group

Motive: Financial: credential and crypto wallet theft via infostealers

How it happened

Attack vector: Fake Prerequisites sections in skill docs instructing users to download password-protected ZIPs or run obfuscated scripts delivering AMOS and other stealers

Root cause: Unvetted skill marketplace with no code review; users trusting install instructions for crypto and social tools

Timeline

Jan 27, 2026First wave of malicious skill uploads to ClawHub
Feb 1, 2026Koi Security completes audit of 2,857 skills, flagging 341
Feb 4, 2026Findings published; OpenClaw adds user reporting

Response

Malicious skills removed from ClawHub; OpenClaw maintainer added a reporting feature; Koi published indicators.

Current status: Contained

Sources (open in a new tab)

ThaiCERT thaicert.or.th
The Hacker News thehackernews.com
SC World scworld.com

Cite this case

Over 230 malicious OpenClaw skills on ClawHub push password stealers. AI Threat Watch, case clawhub-malicious-skills, Feb 4, 2026. https://aithreat.io/cases/clawhub-malicious-skills/

Permanent link: https://aithreat.io/cases/clawhub-malicious-skills/