Case openclaw-skill-remcos-ghostloaderAI supply chainWorldwide
Malicious OpenClaw skill distributes Remcos RAT and GhostLoader
Zscaler ThreatLabz reports that OpenClaw's modular skill architecture was weaponized by a malicious skill that distributes the Remcos RAT and GhostLoader.
HighAttack on AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 14, 2026
- Location
- Worldwide
- Target
- OpenClaw autonomous agent users
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
Zscaler ThreatLabz reports that OpenClaw's modular skill architecture was weaponized by a malicious skill that distributes the Remcos RAT and GhostLoader.
Impact: Unknown; the payloads are the Remcos RAT and GhostLoader.
Who triggered it
Actor: Unknown
Attribution: The summary does not name an actor.
Motive: Unknown
How it happened
Attack vector: Malicious skill installed into OpenClaw agents, which run with high-privilege local system access.
Root cause: Skill architecture of agents with high-privilege local access was weaponized to deliver malware.
Timeline
- Reported by Zscaler ThreatLabz
Response
Zscaler ThreatLabz published analysis. No other response is stated.
Current status: Under investigation
Sources (open in a new tab)
- Zscaler ThreatLabz zscaler.com
Cite this case
Malicious OpenClaw skill distributes Remcos RAT and GhostLoader. AI Threat Watch, case openclaw-skill-remcos-ghostloader, Oct 14, 2026. https://aithreat.io/cases/openclaw-skill-remcos-ghostloader/
Permanent link: https://aithreat.io/cases/openclaw-skill-remcos-ghostloader/