Case vidar-steals-openclaw-secretsModel & data leakWorldwide
Infostealer captures OpenClaw gateway token, device keys and agent memory files
Hudson Rock documented the first infostealer log containing an OpenClaw .openclaw directory: openclaw.json with a gateway auth token, device.json with signing keys and soul.md and memory files holding private messages and calendar data.
MediumAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Feb 16, 2026
- Location
- Worldwide
- Target
- OpenClaw users
- Severity
- Medium
- Triggered by
- Vidar infostealer operators
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Hudson Rock documented the first infostealer log containing an OpenClaw .openclaw directory: openclaw.json with a gateway auth token, device.json with signing keys and soul.md and memory files holding private messages and calendar data.
Impact: Stolen gateway token and device private key allow remote connection, client impersonation and bypass of Safe Device checks; memory files exposed private messages and activity logs
Who triggered it
Actor: Vidar infostealer operators
Attribution: Hudson Rock assessed the malware as a Vidar variant; it was not built for OpenClaw but swept files matching keywords such as token and private key
Motive: Credential theft for resale and account takeover
How it happened
Attack vector: Generic infostealer keyword search over the user's home directory capturing the agent's plaintext configuration and memory files
Root cause: OpenClaw stores gateway tokens, device private keys and agent memory in plaintext files on the host
Timeline
- Victim machine infected; infostealer log includes the .openclaw directory
- Hudson Rock and BleepingComputer report the first observed OpenClaw secret theft
Response
Researchers advised rotating gateway tokens and re-pairing devices; expected infostealers to target agent frameworks routinely
Current status: Ongoing
Sources (open in a new tab)
- BleepingComputer bleepingcomputer.com
- BleepingComputer OpenClaw tag bleepingcomputer.com
Cite this case
Infostealer captures OpenClaw gateway token, device keys and agent memory files. AI Threat Watch, case vidar-steals-openclaw-secrets, Feb 16, 2026. https://aithreat.io/cases/vidar-steals-openclaw-secrets/
Permanent link: https://aithreat.io/cases/vidar-steals-openclaw-secrets/