{"id":"openclaw-clawhub-clawhavoc-malicious-skills-feb-2026","category":"supply-chain","status":"closed","title":"OpenClaw’s ClawHub hosted 341 malicious skills, including the ClawHavoc password-stealing campaign","tldr":"Malicious OpenClaw add-ons used fake setup requirements to deliver password and wallet stealers on Macs and Windows PCs. ClawHub added screening and removed malicious listings. Review installed skills; get malware help if you ran their setup downloads.","summary":"Koi Security disclosed 341 malicious add-ons in OpenClaw’s ClawHub marketplace on 1 February, after auditing 2,857 skills. It associated 335 with ClawHavoc. These skills impersonated useful crypto, finance, YouTube and productivity tools, then presented malware installation as a prerequisite. Windows payloads included a keylogger; Mac payloads were consistent with Atomic Stealer, which targets browser passwords, Apple Keychain credentials, cryptocurrency wallets and Telegram sessions. OpenClaw introduced VirusTotal screening, download blocks and daily rescanning on 7 February, then added further analysis in June. Unit 42 subsequently reported that early malicious listings had been removed or marked malicious, while documenting continued use of earlier infrastructure and new skills copying the delivery pattern. Those findings prevent an all-clear. These are malicious packages rather than a flaw resolved by one OpenClaw version. As at 3 November, the reviewed sources establish neither a complete end to the campaign nor a verified victim count, financial-loss total or recovery outcome.","action":"Review the ClawHub skills installed on your OpenClaw computer and ask a trusted IT professional to check anything suspicious; do not run downloads or commands presented as unexpected setup requirements. If you already ran them, stop using that computer for sensitive accounts and get malware removal help, then reset exposed passwords and revoke sessions from a clean device. If it held cryptocurrency wallet keys, seek help securing those wallets.","product":"OpenClaw third-party skills distributed through ClawHub","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":[],"tags":["openclaw","clawhub","clawhavoc","supply-chain","infostealer","macos","windows","crypto"],"affected":["OpenClaw installations using malicious ClawHub skills targeting macOS or Windows; no affected OpenClaw version range published"],"fixed":[],"matches":[{"platform":"macos","app":"OpenClaw","bundle":"","fixed":""},{"platform":"windows","app":"OpenClaw","bundle":"","fixed":""}],"sources":[{"kind":"advisory","title":"OpenClaw Partners with VirusTotal for Skill Security","url":"https://openclaw.ai/blog/virustotal-partnership","by":"OpenClaw","date":"2026-02-07"},{"kind":"advisory","title":"OpenClaw Collaborates with NVIDIA for Stronger Agent Skill Security","url":"https://openclaw.ai/blog/openclaw-nvidia-skill-security","by":"OpenClaw","date":"2026-06-01"},{"kind":"news","title":"OpenClaw agents targeted with 341 malicious ClawHub skills","url":"https://www.scworld.com/news/openclaw-agents-targeted-with-341-malicious-clawhub-skills","by":"SC Media","date":"2026-02-04"},{"kind":"research","title":"From Automation to Infection: How OpenClaw AI Agent Skills Are Being Weaponized","url":"https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html","by":"VirusTotal","date":"2026-02-02"},{"kind":"news","title":"Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users","url":"https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html","by":"The Hacker News","date":"2026-02-02"},{"kind":"research","title":"OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat","url":"https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/","by":"Palo Alto Networks Unit 42","date":""},{"kind":"news","title":"Multiple malicious OpenClaw skills found online - including two macOS infostealers","url":"https://www.techradar.com/pro/security/multiple-malicious-openclaw-skills-found-online-including-two-macos-infostealers","by":"TechRadar","date":"2026-06-25"}],"started":"2026-02-01","closed":"2026-06-25","created":"2026-11-03T21:24:15.867Z","updated":"2026-11-03T21:24:15.867Z","cve_notes":[],"timeline":[{"at":"2026-06-25","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"TechRadar reported that OpenClaw had removed five further malicious skills identified by Unit 42 and banned their publishers. Unit 42 also said early-campaign skills had been removed or marked malicious, but documented continued use of the earlier malware infrastructure.","url":"https://www.techradar.com/pro/security/multiple-malicious-openclaw-skills-found-online-including-two-macos-infostealers","by":"TechRadar","patch":null},{"at":"2026-06-01","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"OpenClaw added NVIDIA SkillSpector analysis and Skill Cards explaining each skill’s capabilities and origin. Its publication checks combined static analysis, VirusTotal and SkillSpector findings.","url":"https://openclaw.ai/blog/openclaw-nvidia-skill-security","by":"OpenClaw","patch":null},{"at":"2026-05-17","added":"2026-11-03T21:16:05.524Z","kind":"wider-attacks","text":"Two TradingView-themed skills were published using the ClawHavoc delivery pattern, according to Unit 42. They delivered a different Mac stealer called cluw using new infrastructure; this did not establish that the original operators were responsible.","url":"https://unit42.paloaltonetworks.com/openclaw-ai-supply-chain-risk/","by":"Palo Alto Networks Unit 42","patch":null},{"at":"2026-02-07","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"OpenClaw announced VirusTotal scanning for all ClawHub skills, daily rescanning and download blocks for skills classified as malicious. It warned that a clean scan does not establish safety.","url":"https://openclaw.ai/blog/virustotal-partnership","by":"OpenClaw","patch":"partial"},{"at":"2026-02-02","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"VirusTotal reported detecting hundreds of deliberately malicious OpenClaw skills. It identified 314 malicious skills associated with one publisher and confirmed an Atomic Stealer payload targeting Mac passwords, browser credentials and cryptocurrency wallets.","url":"https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html","by":"VirusTotal","patch":null},{"at":"2026-02-01","added":"2026-11-03T21:16:05.524Z","kind":"disclosed","text":"Koi Security disclosed 341 malicious skills among 2,857 audited on ClawHub. Researchers linked 335 to ClawHavoc, which used fake prerequisite instructions to distribute malware to Windows and Mac users.","url":"https://www.scworld.com/news/openclaw-agents-targeted-with-341-malicious-clawhub-skills","by":"SC Media","patch":"none"}],"url":"https://hard.fyi/live/openclaw-clawhub-clawhavoc-malicious-skills-feb-2026/","json":"https://hard.fyi/api/live?id=openclaw-clawhub-clawhavoc-malicious-skills-feb-2026"}