{"schema_version":"0.10.0","id":"LR-2026-0419","record_version":1,"title":"341 malicious ClawHub skills found stealing data from OpenClaw users","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.52,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"c6d541a678fff4b85f6ddce588860caa2bdad2d187fe4d4081d6488edf763d69"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-02-02","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"ClawHub is a marketplace for third-party skills that extend OpenClaw, a self-hosted AI assistant, and OpenClaw users install them. A security audit by Koi Security of 2,857 skills found 341 malicious skills across multiple campaigns. Of these, 335 used fake prerequisites to install the Atomic Stealer macOS malware, and others hid reverse shell backdoors or exfiltrated bot credentials. A report from OpenSourceMalware flagged the same campaign. The marketplace is open by default and lets anyone upload skills, and OpenClaw's creator has since added a reporting feature that hides skills after more than three unique reports.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK06","secondary_risks":["RK04","RK03"],"control_chain":[{"layer":"L3","party":"deployer","party_name":null,"control_id":"G3","outcome":"missing","reason":null,"quote":"The only restriction at this stage is that a publisher must have a GitHub account that's at least one week old.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate: data of others is touched (crypto assets, API keys, wallet keys, SSH credentials, browser passwords) with a bounded scope stated as 341 malicious skills across multiple campaigns.","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html","publisher":"The Hacker News","date":"2026-02-02","type":"press","title":"Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.detection_method":"C","event.adversarial_actor":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security, exposing users to new supply chain risks."}],"event.detection_method":[{"source_index":0,"quote":"A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security, exposing users to new supply chain risks."}],"event.adversarial_actor":[{"source_index":0,"quote":"The findings underscore how open-source ecosystems continue to be abused by threat actors, who are now piggybacking on OpenClaw's sudden popularity to orchestrate malicious campaigns and distribute malware at scale."}],"impact.severity":[{"source_index":0,"quote":"All these skills share the same command-and-control infrastructure (91.92.242[.]30) and use sophisticated social engineering to convince users to execute malicious commands, which then steal crypto assets like exchange API keys, wallet private keys, SSH credentials, and browser passwords."}],"impact.severity_because":[{"source_index":0,"quote":"All these skills share the same command-and-control infrastructure (91.92.242[.]30) and use sophisticated social engineering to convince users to execute malicious commands, which then steal crypto assets like exchange API keys, wallet private keys, SSH credentials, and browser passwords."}],"event.control_chain":[{"source_index":0,"quote":"The only restriction at this stage is that a publisher must have a GitHub account that's at least one week old."}],"event.summary":[{"source_index":0,"quote":"ClawHub is a marketplace designed to make it easy for OpenClaw users to find and install third-party skills."},{"source_index":0,"quote":"A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security, exposing users to new supply chain risks."},{"source_index":0,"quote":"The analysis, which Koi conducted with the help of an OpenClaw bot named Alex, found that 335 skills use fake pre-requisites to install an Apple macOS stealer named Atomic Stealer (AMOS)."},{"source_index":0,"quote":"In addition, the cybersecurity company said it identified skills that hide reverse shell backdoors inside functional code (e.g., better-polymarket and polymarket-all-in-one), or exfiltrate bot credentials present in \"~/.clawdbot/.env\" to a webhook[.]site (e.g., rankaj)."},{"source_index":0,"quote":"The development coincides with a report from OpenSourceMalware, which also flagged the same ClawHavoc campaign targeting OpenClaw users."},{"source_index":0,"quote":"The problem stems from the fact that ClawHub is open by default and allows anyone to upload skills."},{"source_index":0,"quote":"Skills with more than 3 unique reports are auto-hidden by default."}]},"notes_on_gaps":"The sources do not state the date the malicious skills were uploaded or the date of the incident, so date_occurred and date_detected are left out. Source 0 is a press article dated 2026-02-02; I took that as date_disclosed, which is an inference. No affected-user count is stated, so third_parties_affected_count and records_exposed are left out. No dollar loss is stated. The sources do not describe an autonomous agent taking action, so agent_involved and failure_class are left out. Trigger is left out because no cause from the list is clearly stated. Responsible party is left out as not clearly stated. The severity tier moderate is my judgement based on data of others being touched and a bounded scope of 341 skills. The root cause integration is my judgement from the open-marketplace statement. The ClawHavoc and Atomic Stealer details come from a single press article that relays Koi Security and OpenSourceMalware findings; the OpenSourceMalware report itself was not provided. The system model, version and developer are not stated, so system fields are left out. Ordering of the timeline items relies on relative phrases in the article. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: The Hacker News · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"OpenClaw users installed third-party skills from the ClawHub marketplace, an extension to the OpenClaw AI assistant.","quote":"ClawHub is a marketplace designed to make it easy for OpenClaw users to find and install third-party skills.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"A security audit found 341 malicious skills among 2,857 skills on ClawHub, across multiple campaigns.","quote":"A security audit of 2,857 skills on ClawHub has found 341 malicious skills across multiple campaigns, according to new findings from Koi Security, exposing users to new supply chain risks.","source_index":0,"grade":"C"},{"step":"caught","text":"Koi Security's analysis found the malicious skills and the fake prerequisites used to install the Atomic Stealer macOS malware.","quote":"The analysis, which Koi conducted with the help of an OpenClaw bot named Alex, found that 335 skills use fake pre-requisites to install an Apple macOS stealer named Atomic Stealer (AMOS).","source_index":0,"grade":"C"},{"step":"done","text":"OpenClaw's creator rolled out a reporting feature that lets signed-in users flag skills.","quote":"The issue with malicious skills hasn't gone unnoticed by OpenClaw's creator Peter Steinberger, who has since rolled out a reporting feature that allows signed-in users to flag a skill.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html"]},"analysis":{"sections":{"timeline":[{"text":"OpenSourceMalware published a report flagging the same ClawHavoc campaign, coinciding with the Koi findings.","quote":"The development coincides with a report from OpenSourceMalware, which also flagged the same ClawHavoc campaign targeting OpenClaw users.","source_index":0,"when":null},{"text":"OpenClaw's creator later rolled out a user reporting feature for flagging skills.","quote":"The issue with malicious skills hasn't gone unnoticed by OpenClaw's creator Peter Steinberger, who has since rolled out a reporting feature that allows signed-in users to flag a skill.","source_index":0,"when":null},{"text":"Palo Alto Networks had earlier warned that OpenClaw carries a lethal trifecta of risks for AI agents.","quote":"In a report last week, Palo Alto Networks warned that OpenClaw represents what British programmer Simon Willison, who coined the term prompt injection, describes as a \"lethal trifecta\" that renders AI agents vulnerable by design due to their access to private data, exposure to untrusted content, and the ability to communicate externally.","source_index":0,"when":"last week"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html"]}}