Malicious AI skills poisoned OpenClaw plugin hub
Attackers reportedly uploaded 472 malicious AI skills to OpenClaw's ClawHub plugin hub, exploiting weak review processes to distribute backdoor code. Once installed, the skills allowed attackers to steal passwords and personal files from users' devices.
What happened
Attackers uploaded 472 malicious AI skills to ClawHub, the plugin hub for the open-source AI agent project OpenClaw, exploiting weak or nonexistent review mechanisms.
The infected skills disguised themselves as dependency installation packages and contained hidden commands that triggered backdoor functions after being downloaded and executed, allowing attackers to collect passwords and personal files from infected devices.
Reported impact
Users who installed the malicious plugins became vulnerable to data theft, with attackers typically moving toward extortion following the compromise.
Index analysis
SlowMist's threat intelligence tool MistEye issued high-severity alerts linked to 472 malicious skills on the platform. Multiple infected skills pointed to the same malicious domain (socifiapp[.]com, registered in July 2025) and IP address previously associated with Poseidon-linked infrastructure exploits, indicating a coordinated campaign.
The malicious skills were frequently named using terms associated with crypto assets, financial data and automation tools, categories more likely to lower users' vigilance and encourage installation.
Governance controls
SlowMist characterized the review mechanisms in place on ClawHub as weak or nonexistent, allowing malicious code to be published through the platform's normal distribution channels.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.