Malicious OpenClaw skills abused via ClawHub to steal cryptocurrency and browser data

Timeline

1. Feb 9, 2026

   Attackers adapt with 'clean lure, dirty dependency' evasion technique

   After automated scanning was introduced, researchers observed attackers shifting to benign-looking SKILL.md files that redirected users to external malware via fake OpenClawCLI installation pages and obfuscated commands. The change let trojanized skills appear clean to file-based scanners while still delivering payloads from attacker infrastructure.

2. Feb 7, 2026

   OpenClaw partners with VirusTotal to scan all ClawHub uploads

   OpenClaw announced a partnership with VirusTotal to automatically scan every skill uploaded to ClawHub using SHA-256 fingerprinting, lookups, and Code Insight analysis. Malicious skills would be blocked and suspicious ones labeled, though maintainers noted the system would not fully stop instruction-only social-engineering attacks.

3. Feb 5, 2026

   Zenity demonstrates indirect prompt-injection backdoor chain in OpenClaw

   Zenity disclosed a proof-of-concept attack in which malicious content delivered through trusted integrations could cause OpenClaw to create an attacker-controlled integration such as a Telegram bot. Once established, the attacker could use the new channel to exfiltrate files, delete data, or deploy additional tooling like Sliver.

4. Feb 5, 2026

   Snyk discloses widespread secret leakage in ClawHub skills

   Snyk reported that 283 OpenClaw skills, about 7.1% of those examined, exposed sensitive credentials by placing secrets into LLM context or plaintext logs. The findings showed that the marketplace risk extended beyond overt malware to systemic insecure secret handling.

5. Feb 3, 2026

   VirusTotal adds OpenClaw skill support to Code Insight

   As part of its response to the ClawHub abuse, VirusTotal added OpenClaw skill support to its Code Insight tooling to analyze package behavior. The enhancement was intended to help identify malicious skills and unsafe implementations in the ecosystem.

6. Feb 3, 2026

   VirusTotal reports hundreds of malicious OpenClaw skills

   VirusTotal analyzed roughly 3,000 OpenClaw skills and reported that hundreds showed malicious characteristics, including exfiltration, remote-control, and malware-installation behavior. It highlighted publisher hightower6eu as a major source of malicious uploads and showcased examples delivering Windows trojans and AMOS on macOS.

7. Feb 3, 2026

   OpenClaw issues multiple high-impact advisories, including one-click RCE

   The project disclosed three high-impact security advisories in a three-day span, including a one-click remote code execution flaw and two command-injection vulnerabilities. These disclosures added to concerns that the platform itself, not just its skill ecosystem, had serious security weaknesses.

8. Feb 2, 2026

   Broader reporting says hundreds of malicious skills flooded the ecosystem

   By early February, multiple reports described the campaign as having grown to hundreds of malicious skills across ClawHub and GitHub, with counts ranging from 230 to more than 380. The activity was characterized as a supply-chain style malware operation targeting OpenClaw users with credential and crypto theft.

9. Feb 2, 2026

   OpenClaw adds abuse-reporting feature to auto-hide flagged skills

   In response to the malicious-skill findings, OpenClaw creator Peter Steinberger added a reporting feature to ClawHub that automatically hides a skill after more than three unique reports. The change was presented as an immediate mitigation while abuse of the marketplace continued.

10. Feb 2, 2026

    Koi Security finds 341 malicious ClawHub skills across campaigns

    Koi Security audited 2,857 ClawHub skills and identified 341 malicious entries, including 335 linked to a campaign it named ClawHavoc. The malicious skills delivered AMOS-like malware, keyloggers, reverse shells, and credential exfiltration payloads while impersonating legitimate utilities.

11. Feb 2, 2026

    1Password identifies top-downloaded ClawHub skill delivering macOS stealer

    1Password reported that the top-downloaded "Twitter" skill on ClawHub used ClickFix-style instructions to trick users into running an obfuscated command that fetched and executed macOS infostealer malware. The post framed OpenClaw skills as a new supply-chain attack surface where markdown instructions can act as malware delivery.

12. Feb 1, 2026

    OpenSourceMalware discloses ClawHub malware campaign

    OpenSourceMalware published analysis of a large ClawHub/GitHub campaign, reporting hundreds of malicious skills tied to shared infrastructure at 91.92.242.30 and largely attributed to the user hightower6eu. The report described Windows and macOS infostealer delivery, including likely NovaStealer activity on macOS.

13. Jan 29, 2026

    Attackers upload at least 14 malicious skills in initial wave

    Researchers later reported that at least 14 malicious skills were uploaded to the public ClawHub registry between January 27 and 29. Some reached prominent placement on ClawHub, increasing the chance of accidental installation before removal.

14. Jan 27, 2026

    Malicious OpenClaw skills begin appearing on ClawHub and GitHub

    A coordinated campaign started publishing trojanized OpenClaw/ClawdBot/Moltbot skills in two waves on ClawHub and GitHub, largely masquerading as cryptocurrency and automation tools. The activity began on January 27 and used social engineering to push users toward external malware installers.