Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub

Bitdefender researchers reported abuse in OpenClaw's third-party 'skills' ecosystem. In a Feb. 2026 sample, about 17% of skills were reportedly assessed as malicious, with many seemingly cloned under slight name changes. Posing as utilities, some skills were reportedly found to run obfuscated commands, fetch remote payloads, and in some cases deliver AMOS Stealer on macOS. Other skills were reportedly observed searching for private keys or API tokens and exfiltrating them.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.2 AI system security vulnerabilities and attacks

The incident involved threat actors exploiting security vulnerabilities in the OpenClaw agent ecosystem and its open-by-default marketplace to distribute malware and compromise user systems.

Additional risk subdomains

• 4.3 Fraud, scams, and targeted manipulation: The malicious skills targeted specific users to steal cryptocurrency assets and private keys for the perpetrators' financial gain.
• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The malware exfiltrated highly sensitive personal data, including browser passwords, SSH credentials, and private keys.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was caused by malicious human actors who intentionally uploaded malware-infected skills to the ClawHub marketplace after the OpenClaw platform was deployed.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: OpenClaw is a self-hosted AI assistant and chatbot operating through chat and messaging interfaces, which falls under the transparency obligations of Limited Risk systems.

AI system and alleged parties

• AI system: None named
• AI purpose: Chatbot; Scheduling
• Behaviour type: Agent
• Alleged developer: Unknown malicious actors, OpenClaw
• Alleged deployer: Unknown threat actors distributing malicious OpenClaw skills, Unknown threat actors, Unknown malicious actors
• Alleged harmed parties: Organizations using OpenClaw, OpenClaw users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Minor, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The reports describe the theft of cryptocurrency assets and API keys, but do not explicitly quantify the total financial losses.

Directly caused: The average financial loss per occurrence is not quantified in the reports, though individual victims had their crypto wallets drained.

Inferred additional harm: Given that over 300 malicious skills were active and OpenClaw has over 160,000 GitHub stars, it is highly likely that total financial losses from stolen cryptocurrency reach hundreds of thousands or millions of dollars.

Privacy

Reported: The reports explicitly describe widespread privacy violations through the unauthorized exfiltration of sensitive credentials and private keys.

Directly caused: The malicious skills directly harvested and exfiltrated browser passwords, SSH credentials, API keys, and cryptocurrency private keys from infected systems.

Inferred additional harm: It is highly likely that hundreds of users had their private credentials and personal data compromised due to installing the malicious skills.

People affected

• Occurrences reported: 1
• People reportedly harmed: 100
• People reportedly exposed: 500

Potential causes

Management

• Prioritizing Growth Over Security: Rapid project growth to 160k stars outpaced safety and moderation tools.
• Delayed Security Features: Reporting and auto-hiding features were only added after the exploits.
• Inadequate Risk Assessment: Management failed to assess risks of executing untrusted third-party code.

Technology

• Lethal Trifecta Vulnerability: AI agents have access to private data, untrusted content, and external comms.
• Persistent Memory Exploits: Memory allows stateful, delayed-execution attacks like memory poisoning.
• Plain-text Credential Storage: Sensitive keys and API tokens are stored in plain text or env variables.

Data Inputs

• Untrusted Skill Code Execution: AI executes unverified third-party skills with high system privileges.
• Obfuscated Shell Commands: Base64-encoded commands in skill files hide malicious download scripts.
• Malicious External Payloads: External scripts and binaries are fetched from untrusted third-party IPs.

Human Factors

• Social Engineering of Users: Users are convinced to run external binaries and install fake prerequisites.
• Overreliance on Skill Legitimacy: Users trust cloned skills with professional-looking documentation.
• Lack of Code Scrutiny by Users: Users install skills without reviewing the underlying code or commands.

Process and Methods

• Open by Default Marketplace: Anyone with a one-week-old GitHub account can publish skills to ClawHub.
• Inadequate Skill Verification: No automated or manual code review process exists prior to skill publishing.
• Weak Publisher Verification: The only publisher restriction is having a week-old GitHub account.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from multiple cybersecurity firms provide highly detailed technical analyses of the malware, the attack vector, and the specific skills involved. The mechanism of the supply chain attack is clearly documented.
• Ambiguities identified: The exact number of victims who lost funds and the total financial value of stolen cryptocurrency are not specified.
• Alternative interpretations: None. It is clearly a malicious supply chain attack targeting an AI agent ecosystem.

The 'ClawHavoc' campaign represents a significant cyber security incident involving a supply chain attack on the OpenClaw AI agent ecosystem. While it successfully harvested credentials and cryptocurrency from numerous users, its national security impact remains minor, serving primarily as an indicator of emerging vulnerabilities in autonomous AI agent marketplaces.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The active campaign is being mitigated by security firms, but the vulnerability of AI agent ecosystems remains an ongoing strategic security concern.
• Autonomy: Human-supervised. The AI agent executes workflows autonomously, but relies on human installation and initial execution triggers.
• Novelty: Evolved capability. Applies established supply chain attack methods to the emerging and highly vulnerable ecosystem of AI agent marketplaces.

Impact by dimension

• Physical security: Negligible. No physical systems, critical infrastructure, or human safety risks were reported in connection with this software supply chain attack.
• Information security: Minor. The campaign harvested SSH credentials and API tokens which could facilitate unauthorized system access, but there is no evidence of state-sponsored intelligence compromise.
• Sovereignty: Negligible. No impact on state authority, electoral processes, or core government functions was reported.
• Economic security: Minor. The theft of cryptocurrency and API keys represents a minor economic threat to affected individuals and corporate environments, but lacks strategic-level national impact.
• Societal stability: Minor. Widespread privacy violations occurred through credential harvesting, but did not escalate to mass surveillance or societal-scale instability.