OpenClaw Marketplace Flooded with 341 Malicious Skills in Major Supply Chain Attack

A massive, coordinated software supply chain attack has compromised the very heart of the OpenClaw AI assistant ecosystem. Dubbed "ClawHavoc," the campaign flooded the platform's official "ClawHub" skill registry with 341 malicious plugins, using sophisticated social engineering to infect thousands of users with information-stealing malware. The discovery reveals an attack of unprecedented scale against a rapidly growing open-source AI tool, underscoring critical security gaps in emerging AI agent platforms.

Attack Timeline

The attack unfolded rapidly over a single week, exploiting the open and lightly moderated nature of the ClawHub marketplace.

Date	Event
Jan 27 - 29, 2026	Initial wave of at least 14 malicious "skills" uploaded to ClawHub.
Jan 27 - Feb 1, 2026	Second, larger wave published, bringing the total to over 230 malicious packages across ClawHub and GitHub.
Feb 1 - 2, 2026	Koi Security completes a full audit of all 2,857 skills on ClawHub, identifying 341 malicious entries—335 of which belong to the single ClawHavoc campaign.
Feb 2 - 3, 2026	Widespread reporting by security firms and community researchers. OpenClaw creator introduces a user-reporting feature in response.

The attackers meticulously crafted their malicious skills to appear as legitimate, high-demand utilities. Each skill contained professional-looking documentation with a critical "Prerequisites" section instructing users to install a tool called "AuthTool".

On Windows: Users were directed to download a password-protected ZIP file from GitHub, a technique designed to evade automated antivirus scanning.
On macOS: Users were told to copy and paste a base64-encoded shell command from `glot[.]io` directly into the Terminal.

Following these instructions triggered the malware delivery, a method researchers compare to a "ClickFix"-type attack. The final payload for macOS is identified as Atomic macOS Stealer (AMOS), a commodity malware sold for $500–$1,000 per month on Telegram channels.

AMOS Stealer Targets

Once installed, the AMOS stealer is configured to exfiltrate a vast array of sensitive data, posing a severe risk to both personal and professional users. The malware's capabilities include:

Data Type	Specific Targets
Financial & Crypto Assets	Cryptocurrency exchange API keys, wallet files (e.g., `wallet.dat`), seed phrases, and data from over 60 supported browser wallet extensions like MetaMask.
System & Developer Credentials	The entire macOS Keychain, SSH private keys and shell history, cloud service credentials (AWS, Google Cloud, Azure), and Git credentials.
Web Data & Communications	Saved passwords, cookies, and browser profiles from all major browsers (Chrome, Firefox, Safari, Edge), as well as Telegram session data.

Campaign Sophistication

The ClawHavoc campaign displayed a high degree of organization and employed multiple evasion tactics:

Skill Categorization: The 335 ClawHavoc skills were not random; they were precisely tailored to mimic popular tool categories:
Crypto Utilities: 111 skills (e.g., Solana wallet trackers).
YouTube Tools: 57 skills (e.g., video summarizers).
Finance & Social Trends: 51 skills (e.g., Yahoo Finance, X/Twitter trackers).
Prediction Market Bots: 34 skills (targeting Polymarket users).
Auto-Updaters: 28 skills.
Google Workspace Integrations: 17 skills.
Typosquatting: Attackers registered 29 lookalike domain names (e.g., `clawhubb`, `cllawhub`) to catch users making common typing errors.
Infrastructure: All malicious skills in the main campaign shared the same command-and-control infrastructure, centering on the IP address `91.92.242[.]30`.

Ecosystem Vulnerabilities & Responses

This incident is not an isolated flaw but a symptom of systemic issues within the OpenClaw project, which has been described as a "security dumpster fire" by Laurie Voss, head of developer relations at Arize and former CTO of npm.

Platform Instability: OpenClaw has undergone two name changes (ClawdBot → Moltbot → OpenClaw) in under a month, creating confusion that attackers exploit.

Critical Vulnerabilities: In the three days preceding this campaign, the project issued three high-impact security advisories for one-click remote code execution and command injection vulnerabilities.

Limited Moderation: OpenClaw creator Peter Steinberger admitted the platform lacks the capacity to review the massive influx of skill submissions, shifting the security burden to users. The newly introduced reporting feature auto-hides skills after only 3 unique user reports.

Recommended Mitigations

Security experts unanimously recommend a zero-trust approach toward AI agent extensions:

Pre-Installation Scanning: Use the free Koi Security Clawdex scanner to vet any skill before installation[reference:24].
Isolate the Environment: Run OpenClaw inside a virtual machine (VM) or sandbox to prevent malware from reaching the host system[reference:25].
Apply Least Privilege: Never run the AI assistant with administrator or root privileges. Restrict its file system and network access.
Audit and Allowlist: Organizations should audit and allowlist only essential, vetted skills, avoiding public marketplaces for critical functions.
Monitor for Anomalies: Implement network monitoring to detect unauthorized outbound connections to known malicious infrastructure like `91.92.242[.]30`.

The ClawHavoc campaign is a watershed moment, demonstrating that AI agent ecosystems have become high-priority targets for sophisticated supply chain attacks.

The combination of deep system access, persistent memory, and untrusted third-party code creates a "lethal trifecta" of risk, as highlighted by Palo Alto Networks researchers.

As AI assistants evolve from novelties into integral parts of personal and business workflows, the industry must develop robust security frameworks—including code signing, automated registry scanning, and user education—to prevent extensibility from becoming its greatest vulnerability.

OpenClaw Marketplace Flooded with 341 Malicious Skills in Major Supply Chain Attack

Related threat feeds

Hackers Turned ‘404 Not Found’ Into a Kurdish Protest on Army Sites

Attack Timeline

AMOS Stealer Targets

Campaign Sophistication

Ecosystem Vulnerabilities & Responses

Recommended Mitigations

Fake Google and Cloudflare Verification Pages Are Now a Seven Malware Delivery Pipeline

US Government Hit by Yet Another Cyberattack

OpenClaw Marketplace Flooded with 341 Malicious Skills in Major Supply Chain Attack

Related threat feeds

Hackers Turned ‘404 Not Found’ Into a Kurdish Protest on Army Sites

Attack Timeline

A "ClickFix"-Style Social Engineering Attack

AMOS Stealer Targets

Campaign Sophistication

Ecosystem Vulnerabilities & Responses

Recommended Mitigations

Fake Google and Cloudflare Verification Pages Are Now a Seven Malware Delivery Pipeline

US Government Hit by Yet Another Cyberattack