NewsCompaniesFlawsGuides
Get the app
HighPartly fixedClosedUpdated

OpenClaw’s ClawHub hosted 341 malicious skills, including the ClawHavoc password-stealing campaign

Malicious OpenClaw add-ons used fake setup requirements to deliver password and wallet stealers on Macs and Windows PCs. ClawHub added screening and removed malicious listings. Review installed skills; get malware help if you ran their setup downloads.

What to do

Review the ClawHub skills installed on your OpenClaw computer and ask a trusted IT professional to check anything suspicious; do not run downloads or commands presented as unexpected setup requirements. If you already ran them, stop using that computer for sensitive accounts and get malware removal help, then reset exposed passwords and revoke sessions from a clean device. If it held cryptocurrency wallet keys, seek help securing those wallets.

Check your devices
  • OpenClawno fixed version yet
  • OpenClawno fixed version yet

What’s happening

Koi Security disclosed 341 malicious add-ons in OpenClaw’s ClawHub marketplace on 1 February, after auditing 2,857 skills. It associated 335 with ClawHavoc. These skills impersonated useful crypto, finance, YouTube and productivity tools, then presented malware installation as a prerequisite. Windows payloads included a keylogger; Mac payloads were consistent with Atomic Stealer, which targets browser passwords, Apple Keychain credentials, cryptocurrency wallets and Telegram sessions. OpenClaw introduced VirusTotal screening, download blocks and daily rescanning on 7 February, then added further analysis in June. Unit 42 subsequently reported that early malicious listings had been removed or marked malicious, while documenting continued use of earlier infrastructure and new skills copying the delivery pattern. Those findings prevent an all-clear. These are malicious packages rather than a flaw resolved by one OpenClaw version. As at 3 November, the reviewed sources establish neither a complete end to the campaign nor a verified victim count, financial-loss total or recovery outcome.

What
Poisoned software
Affects
OpenClaw third-party skills distributed through ClawHub
Affected
OpenClaw installations using malicious ClawHub skills targeting macOS or Windows; no affected OpenClaw version range published
Fixed in
No fix yet
Since
1 Feb 2026
Closed
25 June 2026

Timeline

  1. Update

    TechRadar reported that OpenClaw had removed five further malicious skills identified by Unit 42 and banned their publishers. Unit 42 also said early-campaign skills had been removed or marked malicious, but documented continued use of the earlier malware infrastructure.

  2. Update

    OpenClaw added NVIDIA SkillSpector analysis and Skill Cards explaining each skill’s capabilities and origin. Its publication checks combined static analysis, VirusTotal and SkillSpector findings.

  3. Wider attacks

    Two TradingView-themed skills were published using the ClawHavoc delivery pattern, according to Unit 42. They delivered a different Mac stealer called cluw using new infrastructure; this did not establish that the original operators were responsible.

  4. UpdatePartly fixed

    OpenClaw announced VirusTotal scanning for all ClawHub skills, daily rescanning and download blocks for skills classified as malicious. It warned that a clean scan does not establish safety.

  5. Update

    VirusTotal reported detecting hundreds of deliberately malicious OpenClaw skills. It identified 314 malicious skills associated with one publisher and confirmed an Atomic Stealer payload targeting Mac passwords, browser credentials and cryptocurrency wallets.

  6. Made publicNo fix yet

    Koi Security disclosed 341 malicious skills among 2,857 audited on ClawHub. Researchers linked 335 to ClawHavoc, which used fake prerequisite instructions to distribute malware to Windows and Mac users.

Sources

  1. OpenClaw Partners with VirusTotal for Skill SecurityOpenClaw · 7 Feb 2026
  2. OpenClaw Collaborates with NVIDIA for Stronger Agent Skill SecurityOpenClaw · 1 June 2026
  3. OpenClaw agents targeted with 341 malicious ClawHub skillsSC Media · 4 Feb 2026
  4. From Automation to Infection: How OpenClaw AI Agent Skills Are Being WeaponizedVirusTotal · 2 Feb 2026
  5. Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw UsersThe Hacker News · 2 Feb 2026
  6. OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain ThreatPalo Alto Networks Unit 42
  7. Multiple malicious OpenClaw skills found online - including two macOS infostealersTechRadar · 25 June 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS