incidents.si
INC-2026-0001SEV2 · Highsupply-chainreported

Hundreds of malicious skills found on the OpenClaw agent marketplace

An audit by Koi Security found 341 malicious skills on ClawHub. Most told users to install a "prerequisite" that was an information stealer.

Disclosed
Published
Organization
OpenClaw
System
ClawHub skill marketplace for the OpenClaw AI assistant
Impact
341 of 2,857 audited skills were malicious; they installed credential-stealing malware on users’ machines

Timeline

  • Early February 2026. Koi Security audits all 2,857 skills on ClawHub.
  • 2026-02-02. The Hacker News reports the findings.
  • Afterwards. OpenClaw’s creator adds a way for signed-in users to report a skill.

Trigger or entry point

Users installed third-party skills for their self-hosted assistant. ClawHub accepted uploads from any GitHub account older than one week, according to The Hacker News.

Failure mechanism

Of the 341 malicious skills, 335 belonged to one campaign, which the researchers named ClawHavoc. The skills looked professional and posed as crypto tools, YouTube utilities and updaters. Their documentation had a “Prerequisites” section that told the user to download an archive on Windows or paste a script into the terminal on macOS. On macOS this installed Atomic Stealer, a commodity information stealer. A few other skills hid backdoors in working code or sent the assistant’s credentials to an outside server. On Windows the archive contained a trojan with keylogging functions. The Hacker News notes that Atomic Stealer is sold as a service for $500 to $1,000 a month, and that a second research group, OpenSourceMalware, flagged the same campaign.

Impact

The malware collects API keys, wallet keys, SSH credentials and browser passwords, including credentials the assistant itself can reach. Neither report gives the number of victims. The Hacker News links the focus on macOS to reports of people buying Mac Minis to run the assistant around the clock.

Response

OpenClaw’s creator added a reporting feature for skills.

Mitigations

Neither report describes a review process for uploads beyond the reporting feature.

Sources

  1. Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Userssecondary · 2026-02-02
  2. Hundreds of Malicious Skills Found in OpenClaw’s ClawHubsecondary · 2026-02-03

Corrections

No corrections have been made to this entry.

Report a correction