OpenClaw Skills on ClawHub Used to Distribute AMOS Stealer and Steal Credentials
Security researchers discovered that over 300 malicious OpenClaw Skills posted on the ClawHub marketplace delivered the AMOS Stealer infostealer and other credential-stealing malware to macOS and Windows users. The campaign, dubbed ClawHavoc, involved Skills masquerading as cryptocurrency wallets, YouTube utilities and other common tools to deceive users into executing hidden payloads.
What happened
Researchers at Bitdefender Labs and Koi Security identified 341 malicious OpenClaw Skills hosted on ClawHub, an open-source marketplace for tools that extend OpenClaw AI agents. Roughly 17% of reviewed Skills exhibited malicious intent, typically by cloning common utilities and hiding execution behind obfuscated shell commands.
For macOS users, malicious Skills contained base64-encoded scripts that fetch and execute second-stage payloads including the AMOS Stealer infostealer. For Windows users, Skills directed downloads of password-protected ZIP files from GitHub containing keyloggers such as AuthTool.exe.
Reported impact
AMOS is capable of stealing Keychain credentials, browser data, cryptocurrency wallet data, Telegram sessions and chat logs, SSH keys and files from common folders including Documents and the Desktop. More than 100 ClawHavoc campaign Skills posed as cryptocurrency-related tools such as Solana wallets and Phantom wallet utilities.
Additional malicious Skills included 57 posed as YouTube utilities, 51 presented as finance or social media tools, Polymarket-themed skills containing reverse shell backdoors, and a weather tool that exfiltrates credentials from OpenClaw's configuration file.
Index analysis
Koi Security Researcher Oren Yomtov audited all 2,857 skills available on ClawHub and discovered that 335 of the 341 malicious skills were seemingly tied to the same campaign dubbed 'ClawHavoc.' Researchers mapped specific Skill paths and reconstructed the execution chain, finding stagers frequently parked on paste sites and served from a repeatedly used IP address.
Recurring tradecraft included Base64-wrapped commands, remote script pulls from glot.io and GitHub across multiple repos, and reliance on a single IP for hosting malicious binaries.
Governance controls
Koi Security published a skill called Clawdex that scans skills prior to installation, checking them against a database of known malicious skills.
Recommended mitigations include treating OpenClaw Skills as untrusted software, requiring code review for community additions, using endpoint protection that flags suspicious command execution, and keeping private keys and API tokens in hardened, isolated stores.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.