{"id":10353,"date":"2026-02-03T10:03:46","date_gmt":"2026-02-03T10:03:46","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/02\/03\/openclaw-ai-agent-skills-abused-by-threat-actors-to-deliver-malware\/"},"modified":"2026-02-03T10:03:46","modified_gmt":"2026-02-03T10:03:46","slug":"openclaw-ai-agent-skills-abused-by-threat-actors-to-deliver-malware","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/02\/03\/openclaw-ai-agent-skills-abused-by-threat-actors-to-deliver-malware\/","title":{"rendered":"OpenClaw AI Agent Skills Abused by Threat Actors to Deliver Malware"},"content":{"rendered":"

OpenClaw AI Agent Skills Abused by Threat Actors to Deliver Malware
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Hundreds of malicious skills designed to deliver trojans, infostealers<\/a>, and backdoors disguised as legitimate automation tools.<\/p>\n

VirusTotal has uncovered a significant malware distribution campaign targeting OpenClaw, a rapidly growing personal AI agent ecosystem.<\/p>\n

OpenClaw, previously known as Clawdbot and briefly as Moltbot, is a self-hosted AI agent<\/a> that executes real system actions, including shell commands, file operations, and network requests.<\/p>\n

OpenClaw Skill Abuse Campaign<\/strong><\/h2>\n

The platform extends functionality through skills, small packages built around SKILL.md files that users discover and install from ClawHub, the public marketplace for OpenClaw<\/a> extensions.<\/p>\n

\"Users
Users run untrusted code during setup (source: VirusTotal)<\/figcaption><\/figure>\n

While this architecture enables powerful automation capabilities, it creates a dangerous attack surface.<\/p>\n

Skills run as third-party code with complete system access, often requiring users to paste commands into terminals, download binaries, or execute scripts during setup.<\/p>\n

Threat actors are exploiting this trust model to distribute malware<\/a> through seemingly helpful tools.<\/p>\n

\"A
A Mach-O binary flagged by 16 engines (source: VirusTotal)<\/figcaption><\/figure>\n

VirusTotal Code Insight has analyzed over 3,016 OpenClaw skills, and hundreds of them exhibit malicious characteristics.<\/p>\n

\"Base64-obfuscated
Base64-obfuscated macOS script( source : VirusTotal)<\/figcaption><\/figure>\n

The analysis, powered by Gemini 3 Flash, examines security behaviors such as external code execution, sensitive data access, and unsafe network operations, rather than relying solely on traditional antivirus signatures.<\/p>\n

\"Gemini
Gemini 3 Pro flags it as AMOS infostealer( source : VirusTotal)
<\/figcaption><\/figure>\n

Security researchers identified two distinct threat categories: skills that contain poor security practices, such as insecure APIs, hardcoded secrets, and unsafe command execution.<\/p>\n

Intentionally malicious skills designed for data exfiltration, remote control, and malware<\/a> installation.<\/p>\n

Prolific Malware Publisher<\/strong><\/h2>\n

A particularly concerning case involves ClawHub user \u201chightower6eu,\u201d who published 314 malicious skills covering crypto analytics, finance tracking, and social media analysis.<\/p>\n

Each skill instructs users to download and execute external code from untrusted sources during setup. One example, a \u201cYahoo Finance\u201d skill, appeared clean to traditional antivirus engines<\/a>.<\/p>\n

However, VirusTotal Code Insight identified instructions directing Windows users to download a password-protected ZIP file<\/a> containing openclaw-agent.exe, which multiple vendors have detected as a packed trojan.<\/p>\n

For macOS users, the skill pointed to a Base64-obfuscated shell script on glot.io. That downloaded and executed a Mach-O binary identified as Atomic Stealer (AMOS)<\/a>, an infostealer targeting passwords, browser credentials, and cryptocurrency wallets.<\/p>\n

Organizations and users should treat skill folders as trusted-code boundaries, implement sandboxed execution, and avoid skills that require shell commands or binary downloads.<\/p>\n

Marketplace operators should implement publish-time scanning to flag remote execution and obfuscated scripts.<\/p>\n

VirusTotal is exploring integration<\/a> with OpenClaw\u2019s publishing workflow to provide automated security analysis during skill submission.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post OpenClaw AI Agent Skills Abused by Threat Actors to Deliver Malware<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Abinaya
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

OpenClaw AI Agent Skills Abused by Threat Actors to Deliver Malware Hundreds of malicious skills designed to deliver trojans, infostealers, and backdoors disguised as legitimate automation tools. VirusTotal has uncovered a significant malware distribution campaign targeting OpenClaw, a rapidly growing personal AI agent ecosystem. OpenClaw, previously known as Clawdbot and briefly as Moltbot, is a […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1636,129,63],"tags":[130],"class_list":["post-10353","post","type-post","status-publish","format-standard","hentry","category-cyber-attack-news","category-cyber-security","category-cyber-security-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10353"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=10353"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/10353\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=10353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=10353"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=10353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}