Incident 1368: Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub

incidentdatabase.ai · article · 2026-02-01 Reader 🖥️

Agent Security Agent Skills OpenClaw Software Supply-Chain Security

Malicious actors are exploiting the OpenClaw Skills ecosystem on ClawHub to distribute credential-stealing malware (notably AMOS Stealer), and organizations must treat community-contributed Skills as untrusted software requiring validation and code review.

practical · expository — An incident report summarizing a security research finding. Structured as summary-investigation-mitigation-response, typical of threat intelligence reports. Practical in orientation: it tells practitioners what happened and what to do about it.

Structure

Part	Role
Summary	States the core finding: ~17% of reviewed OpenClaw Skills are malicious, focused on crypto-wallet and credential theft
Investigation	Details the attacker tradecraft: obfuscation techniques, hosting infrastructure, execution chain reconstruction
Mitigation	Prescribes defensive posture: treat Skills as untrusted, validate downloads, require code review, use endpoint protection
Response	Prescribes incident response: isolate, block, forensics, credential reset, monitoring

Key terms

OpenClaw Skills Agent Skills
Executable extensions or plugins in the OpenClaw ecosystem that can be distributed via ClawHub — analogous to packages or extensions but with broader system access
ClawHub OpenClaw
A community repository/marketplace for sharing OpenClaw Skills, analogous to package registries like npm or PyPI
AMOS Stealer Agent Security
A specific macOS infostealer malware family used as the end payload in this attack chain
Stagers
Intermediate components in a malware delivery chain that fetch and execute the final payload

Propositions

explicitRoughly 17% of reviewed OpenClaw Skills exhibited malicious intentconf: high
explicitMalicious Skills focus on stealing crypto-wallet data and user credentialsconf: high
explicitAttackers clone common utilities and hide malicious execution behind obfuscated shell commandsconf: high
explicitA single IP address is repeatedly used for hosting malicious binaries, suggesting a common actor or coordinated campaignconf: high
implicitestablishedThe OpenClaw Skills ecosystem lacks sufficient vetting to prevent malicious submissions at scaleconf: high
supports ←Breaking: Autonomous Agents are a Shitshow · p5 — The OpenClaw/Moltbook mass compromise (770k agents) is cited as empirical validation that the Skills ecosystem lacks sufficient vetting to prevent malicious submissions at scale.
extends ←Building AI Agents For The Enterprise · p12 — Moves from the incident's diagnosis (open skill ecosystems lack vetting) to a governance remedy: admin-controlled plugin marketplaces for skill distribution.
supports ←AI as an Enterprise Operating System · p7 — The incident shows a skills ecosystem lacking sufficient vetting to prevent malicious submissions at scale; Trail of Bits' curated marketplace plus package-cooldown practice is presented as exactly the kind of vetting layer whose absence that incident demonstrates.
extends ←Zero to Agent in 30 Minutes: Build a Supply Chain for Agent Context with Maxim Salnikov · p8 — Proposes the missing governance mechanism — a vetted registry gated by policy, plus CI-enforced drift audits — for exactly the vetting failure the OpenClaw incident documents in an unvetted public skills marketplace.
extends ←Running Python code in a sandbox with MicroPython and WASM · p1 — Locates the deeper structural cause behind the vetting gap: plugin/skill code granted full host privileges is unsafe regardless of how well submissions are vetted.
implicitestablishedCommunity extension ecosystems for AI tools face the same supply-chain attack risks as traditional package managersconf: medium
extends ←Breaking: Autonomous Agents are a Shitshow · p5 — Takes the supply-chain-risk claim further: the OpenClaw compromise empirically validates the whole agentic threat model at 770,000-agent scale, not just package-manager-style risk.
supports ←Fighting Tool Sprawl: The Case for AI Tool Registries · p4 — Both frame agent-tool ecosystems as structurally identical to package managers, inheriting the same supply-chain attack surface.
supports ←vlt 1.0 Ships as a Drop-in npm Replacement with Phased Installs, Graph Queries, and Malware-Blocking · p10 — That extraction argues community extension ecosystems for AI tools face the same supply-chain risks as traditional package managers; vlt's launch shows the traditional-package-manager side of that comparison now actively hardening (phased installs, registry-level rejection) in ways the AI-tool extension ecosystem it's compared against has not yet matched.

Arguments

OpenClaw Skills should be treated as untrusted software strength: high

Explicit premises:

17% of reviewed Skills exhibited malicious intent
Malicious Skills use obfuscation to hide their true behavior
End payloads include credential-stealing malware like AMOS Stealer

Implicit premises:

Users currently trust and run Skills without sufficient scrutiny
The platform does not provide adequate automated vetting

Inferences:

The high rate of malicious Skills means any unvetted Skill poses meaningful risk
Obfuscation means casual inspection is insufficient — formal code review is needed

Narratives

Researchers reconstructed a specific execution chain: a cloned utility Skill contains Base64-wrapped commands that pull remote scripts from glot.io and GitHub, fetching binaries from a known malicious IP, ultimately delivering AMOS Stealer
→ Provides a concrete, traceable example that makes the abstract threat tangible and demonstrates the sophistication of the attack

Questions addressed

✅ How are attackers exploiting the OpenClaw Skills ecosystem?
By cloning popular utilities, embedding obfuscated shell commands that stage and download malware from paste sites and a shared IP
✅ How prevalent is the threat?
Approximately 17% of reviewed Skills are malicious (341 identified)
✅ What should defenders do to prevent and respond to this threat?
Treat Skills as untrusted software, require code review, use endpoint protection, and follow standard IR procedures if compromised
⭕ Who is behind the campaign?
Attribution is not discussed; the shared IP suggests coordination but no actor is named

Gaps

incompleteNo discussion of ClawHub's platform-level response — whether malicious Skills were removed, whether new review processes were implemented, or what the platform's governance model is
Read next: Look for ClawHub's official response or policy changes post-disclosure
closed byFighting Tool Sprawl: The Case for AI Tool Registries — Names the governance/vetting model the incident shows is absent: a centralized registry with discovery, versioning, certification metadata, and access-control foundations.
incompleteThe 17% figure lacks context: how were the reviewed Skills sampled? Is this 17% of all Skills or 17% of a targeted subset? The total corpus size (341 malicious) is mentioned but the denominator is unclear
Read next: Read the original Bitdefender Labs report (linked via SOC Prime) for methodology details
incompleteNo attribution or threat-actor analysis despite the single-IP indicator suggesting a coordinated campaign
Read next: Search for threat intelligence reports linking the identified IP and AMOS Stealer campaigns to known threat actors
incompleteNo discussion of how this compares to similar supply-chain attacks in other extension ecosystems (npm, PyPI, VS Code extensions), which would contextualize the severity
Read next: Compare with research on malicious packages in npm/PyPI registries for framing
closed byFighting Tool Sprawl: The Case for AI Tool Registries — Provides the missing comparison to package-manager ecosystems, framing the agent-tool coordination and supply-chain problem as structurally identical to what npm/PyPI-style registries solve.