OpenClaw, a platform for AI agents that execute third-party skills from its dedicated marketplace, ClawHub, has been targeted by persistent and evolving malicious campaigns. These attacks leverage the unique architecture of AI agent ecosystems, where skills, defined by markdown-driven packages, possess broad access to local systems, making ClawHub a critical vulnerability in the agentic software supply chain.
Early campaigns, reported in February 2026, saw a significant number of malicious skills on ClawHub. Bitdefender Labs found that approximately 17% of analyzed OpenClaw skills contained malicious payloads in the platform's initial weeks. Koi Security's "ClawHavoc" disclosure identified 341 malicious skills, and Trend Micro confirmed skills distributing Atomic macOS Stealer (AMOS) malware. These early attacks employed various techniques, including Base64-encoded `curl-pipe-bash` droppers, platform-specific delivery mechanisms, and persistence through auto-updaters that registered scheduled cron jobs. Some attackers also used alternative exfiltration channels, such as the Telegram Bot API, for cryptocurrency private keys. A notable tactic involved a single publisher injecting identical malicious payloads into most of their skill catalog to maximize installation surface.
These initial findings prompted ClawHub to implement proactive screening measures, integrating VirusTotal and its own ClawScan tool to analyze code and block malicious skills from download. However, analysis conducted between February and May 2026 revealed that malicious skills continued to evade these detection mechanisms. Five such unblocked skills were identified and subsequently reported to ClawHub, leading to the banning of associated accounts and the deletion of the skills.
These five skills fell into three distinct threat categories. Two were macOS infostealers, connecting to command-and-control (C2) infrastructure, indicating ongoing threat actor activity. One skill employed an evasion technique by inflating its file size to exceed scanner thresholds, thereby bypassing both ClawScan and VirusTotal. The remaining two skills represented novel agentic threats: runtime agentic affiliate injection and agentic front-running, both designed for financial gain.
The AMOS dropper infrastructure from the earlier campaigns remained active for over three months after its public disclosure, with the C2 server at 91.92.242[.]30 continuing to receive new skill deliveries. Additionally, new attacks emerged that adapted to and exploited skill marketplaces, leveraging the agentic execution model to implement financial schemes that evaded some forms of malware detection.
One specific instance involved two skills published on May 17, 2026, targeting TradingView users. These skills, posing as AI assistants for macOS traders, embedded a malicious prerequisite block. This block directed agents to a paste-site redirect lure at `hxxps[:]//rentry[.]co/openclaw-code`, which provided instructions for copying and pasting a Base64-encoded string into a terminal. Executing this command fetched a macOS infostealer named `cluw` (SHA256 hash: `818aea6143282b352fdfdc0f3ebf77a36e54eb3befb5cad1a355a99ab97c6aa7`) from `hxxp[:]//2.26.75[.]16/Xuvewuyur`. This delivery mechanism mirrored the "ClawHavoc" campaigns previously documented.
OpenClaw is now collaborating with NVIDIA to enhance skill screening. This partnership aims to provide detailed documentation of each skill's functionality and to run NVIDIA's analysis tools on all published skills. This initiative seeks to further strengthen the security posture of the ClawHub marketplace against the evolving landscape of AI supply chain threats.
