400+ Malicious OpenClaw Skills Spreading Password-Stealing Malware: What Users Need to Know
Clawdbot’s successor, OpenClaw, has surpassed many trending AI tools. While the OpenClaw became viral, so did the large-scale malware campaigns.
The recent revelation of 400+ malicious OpenClaw “skills” has shaken the AI industry. These malicious codes were uploaded during the days of their popularity.
Most of them represented themselves as cryptocurrency trading tools that tricked crypto users into installing them. And that installation caused a massive malware-crypto heist on Windows and macOS.
This was the first major supply chain attack that targeted AI agent skill marketplaces. It displayed that attackers could exploit open-source AI ecosystems and spread them like a viral thing.
It is time to understand what OpenClaw is, how attackers used it, who was the target, and why massive security flaws lie within the AI systems.
Other people are reading: How to Write Blog Posts with OpenClaw?
OpenClaw and Malicious Skills:
OpenClaw is an open-source AI assistant to manage inbox and messaging apps. It runs on a local machine. In November 2025, Peter Steinberger launched it with the name ClawdBot. Which later renamed as Moltbot and again rebranded as OpenClaw.
As the OpenClaw became famous because of its capabilities to manage messages, it failed to keep its claws locked from attackers.
OpenClaw platform users LLMs such as OpenAI API or Anthropic’s Claude Code to allow users to interact with AI agents. It uses messaging apps as communication tools.
OpenClaw Connect with these messaging apps:
- Microsoft Teams
- Slack
- Telegram
- Signal
- iMessage
The primary reason why OpenClaw gained popularity is because of its support for community-created “skills.” These skills work as plugins that enhance the capabilities of AI agents. Skills are used to automate tasks such as file management, trading bots, data analysis and control.
While OpenClaw offered flexibility to its users, the same flexibility became the target for attackers. Attackers created malicious skills to interact with local applications and steal sensitive data.
Discovery: 400+ Malicious skills
Till now, the OpenSourceMalware community discovered 400+ malicious skills in OpenClaw. These skills are running coordinated malware attacks on user machines.
The OpenSourceMalware community reported:
- Between January 27 and 29, 28 malicious skills were uploaded to OpenClaw.
- Between January 31 and February 2, 386 more malicious skills were added.
- Over 400 fake skills were linked to the same infrastructure and malware campaign.
These skills established false legitimacy by getting published on ClawHub and GitHub. These were professionally documented and publicly available.
How the OpenClaw Malware Attack Worked:
Disguised as Crypto Trading Tools:
The malicious skills uploaded on OpenClaw disguised themselves as crypto trading tools. Users trusted them as crypto automation tools and installed them on local machines.
Malicious skills used recognized brand names such as:
- Axiom
- Polymarket
- ByBit
The attack was intentional. Attackers knew that crypto traders often store private keys, wallet credentials, and API tokens on local machines.
Social Engineering:
Attackers did not exploit the OpenClaw’s code. Instead, they used social engineering.
They created fake skills and let the users install AuthTools. These tools claimed they were required for enhanced functionality or authentication.
As users downloaded these, they installed malicious scripts:
- Downloaded malware from remote servers.
- Executed system commands.
- Installed information stealers.
The OpenSourceMalware community described this approach as a ClickFix scam. It convinced users to run malicious commands under the assumptions as they were fixing something.
Shared Command-and-Control Infrastructure:
All malicious skills are part of the same Command-and-Control infrastructure. It clears the fact that the attack was coordinated and intentional.
Shared Command-and-Control Infrastructure Allows Attackers to:
- Exfiltrate stolen credentials
- Monitor infected systems
- Maintain persistence across multiple victims
Attackers also reused the same infrastructure to connect with hundreds of skills quickly.
What Data Was Targeted:
The OpenClaw malware skills were stealing information. They were designed to harvest sensitive crypto data from both Windows and macOS.
The stolen data included:
- Cryptocurrency wallet private keys
- Exchange API keys
- Browser-stored passwords
- SSH credentials
- Authentication tokens
- Sensitive local files
The stolen crypto keys caused financial loses to crypto users. The damage is irreversible.
One Account Behind the Whole Malicious Campaign:
Hightower6eu is the ClawHub account that was behind these malware attacks.
hightower6eu id used to exploit user data:
- Published identical skills
- Became the most downloaded publisher
- Thousands of downloads before detection.
hightower6eu uses repetition and volume to increase credibility and visibility. It took advantage of ClawHub’s limited security checks and moderation flaws.
How Malicious OpenClaw Skills Attack Is a Supply Chain Attack:
Researchers classified the malware campaign as a software supply chain attack. It does not attack the OpenClaw. Instead, it used the platform’s ecosystem to run multiple attacks.
Rather than hacking OpenClaw, attackers did these:
- Uploaded malicious skills
- Leveraged user trust
- Used official distribution channel
- Achieved malware distribution
This is the same approach discovered in previous supply chain attacks on open-source platforms.
Security Gaps in the OpenClaw Ecosystem:
OpenClaw’s ecosystem also has flaws that helped the attackers achieve their intentions.
Lack of Skill Review and Moderation:
- ClawHub is not enough to review and moderate skills.
- Researchers found these flaws:
- No malware scanning
- No manual reviews
- No code auditing
Sometimes the malicious codes were even visible in repositories and skills available publicly.
Deep System Permissions:
The need for local machines to run the OpenClaw architecture is itself a risk.
Security experts warned that:
- It can execute shell commands.
- Access privacy files
- Interact with other applications.
Once installed in local machine, a compromised skill can efficiently act with user-level authority.
Industry Experts' feedback:
Industry experts and critics review this incident as a significant lesson. It is not just about one platform.
Diana Kelley, CISO at Noma Security, explained that malicious skills turn a familiar supply-chain problem into a higher-impact threat.
Jamieson O’Reilly, a penetration tester who exposed OpenClaw vulnerabilities, is now working as a new security representative.
Why Malicious OpenClaw Skills Targeted Crypto Users:
The target of Malicious OpenClaw Skills was to steal information from crypto users.
Here are the common reasons why crypto users were the easy target:
- Crypto uses store private keys on a local machine, which is easy to steal and cause financial loses.
- Browser wallet and extension are easy to exploit.
- Users manage API keys for automated trading, which gives malicious skills an edge to track users.
- Users operate on multiple crypto exchanges.
- Financially motivated attackers target crypto users to steal their information and cryptocurrencies. It is easy to monetize stolen crypto data anonymously.
It is a must to learn how to keep cryptos safe.
What This Means for AI Agent Platforms:
This incident exposes the vulnerability and challenges of AI platforms.
Trust is Expanding:
AI assistants are becoming a need for everyday users. AI assistants can take control, run commands, and manage workflows. These create a surface for malicious attacks.
Open Ecosystems:
Open ecosystems without governance invite attackers. Community AI marketplaces should implement safeguards such as mandatory code reviews, automated malware scanning, reputation systems, and permission-based access control.
Social Engineering is a Threat:
The success of the OpenClaw malicious chain attack reveals the risks of social engineering. It is necessary to make the user aware of the benefits and limitations of the platform.
How Users Protect Themselves:
If you use MoltBot, OpenClaw, or another AI assistant, then take these precautions:
Avoid Unverified Skills:
- Install skills from trusted developers only.
- Check the GitHub community and activity
- Avoid newly published skills
Never Run Unknown Commands:
- If you do not understand a command, then do not run it.
- Do not manually execute shell commands.
Use Separate Environments:
- Run AI assistants in virtual machines
- Do not grant unnecessary file system access
Monitor System Activity:
- Beware of unusual network connections
- Use endpoint protection tools
Conclusion:
OpenClaw is not free from attackers and malicious skills. The discovery of 400+ malicious skills is a bigger threat than any other attack. It displays that attackers are adapting new AI technologies.
Attackers use trust, a weak marketplace, and speed to perform malicious attacks. Without safeguards, an AI assistant can become a risky tool.
Automation and convenience require strong safeguards.
FAQs:
What is the OpenClaw malware incident?
It involves 100+ malicious skills that target crypto users to steal their keys and credentials.
What are OpenClaw skills?
OpenClaw skills are the community-created extensions to enhance the AI agents.
How did attackers spread malware through OpenClaw?
Attackers used social engineering to make users install malicious software on local machines.
What type of malware was used in this campaign?
Information-stealing malware (infostealers) was used.
Which operating systems were targeted?
Windows and macOS systems were targeted.
Who discovered the malicious skills?
Vulnerability researcher Paul McCarty (aka 6mile) is the first person to discover malicious skills.
Are the malicious skills still available?
Yes.
Other helpful articles:
