{"id":13860,"date":"2026-06-25T10:03:41","date_gmt":"2026-06-25T10:03:41","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/06\/25\/openclaw-skill-marketplace-exposes-ai-agents-to-supply-chain-malware-and-financial-fraud\/"},"modified":"2026-06-25T10:03:41","modified_gmt":"2026-06-25T10:03:41","slug":"openclaw-skill-marketplace-exposes-ai-agents-to-supply-chain-malware-and-financial-fraud","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/06\/25\/openclaw-skill-marketplace-exposes-ai-agents-to-supply-chain-malware-and-financial-fraud\/","title":{"rendered":"OpenClaw Skill Marketplace Exposes AI Agents to Supply Chain Malware and Financial Fraud"},"content":{"rendered":"

OpenClaw Skill Marketplace Exposes AI Agents to Supply Chain Malware and Financial Fraud
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A wave of malicious skills targeting the OpenClaw AI agent marketplace has exposed a dangerous new frontier in software supply chain security. <\/p>\n

Attackers are using the ClawHub skill marketplace to push harmful code into AI agent environments, stealing data and running financial fraud schemes that traditional security tools failed to catch.<\/a><\/p>\n

OpenClaw is an AI agent that runs third-party skills sourced from ClawHub, a dedicated marketplace. These skills are markdown-driven packages with deep access to local systems. <\/p>\n

When a malicious skill is installed, it can seize full control of the agent\u2019s identity and execute unauthorized actions through the agent\u2019s own authenticated sessions, all without needing a conventional exploit.<\/a><\/p>\n

Researchers from\u00a0Unit 42\u00a0said in a report<\/a> shared with Cyber Security News (CSN) that their analysis between February and May 2026 uncovered five malicious skills that slipped past ClawHub\u2019s integrated VirusTotal and ClawScan screening. <\/p>\n

\n
\"ClawHub
ClawHub marketplace listings for two TradingView assistant skills (Source \u2013 Unit42)<\/figcaption><\/figure>\n<\/div>\n

All five were reported for takedown, and the associated accounts were subsequently banned.<\/a><\/p>\n

The five skills fell into three threat categories: infostealers connected to command-and-control infrastructure, a file-padding evasion tool designed to exceed scanner thresholds, and two novel agentic threats built for financial gain. <\/p>\n

Bitdefender Labs had previously flagged that roughly 17% of skills on the platform carried malicious payloads, and Koi Security\u2019s ClawHavoc disclosure documented 341 malicious skills across the marketplace<\/a>.<\/a><\/p>\n

The persistence of these threats, even after automated screening was introduced, signals that the risk to AI agent ecosystems is far from resolved. <\/p>\n

The core problem is that malicious skills use natural language to hijack the AI\u2019s own instruction-following behavior, bypassing guardrails that protect more conventional software environments<\/a>.<\/a><\/p>\n

OpenClaw Skill Marketplace Exposes AI Agents<\/strong><\/h2>\n

Two of the five threats were skills disguised as TradingView productivity assistants for macOS. <\/p>\n

Both embedded a malicious prerequisite block that directed agents to a paste-site redirect lure at rentry[.]co\/openclaw-code, where a Base64-encoded command waited to be run in a terminal window. <\/p>\n

\n
\"Paste-site
Paste-site redirect lure (Source \u2013 Unit42)<\/figcaption><\/figure>\n<\/div>\n

That command then pulled a macOS infostealer named cluw from a remote server at 2.26.75[.]16.<\/a><\/p>\n

A separate skill called omnicogg embedded the AMOS malware dropper inside a README.md file, then padded it with 22 MB of junk characters to exceed file size limits that most scanning pipelines enforce. <\/p>\n

\n
\"The
The omnicogg skill\u2019s README.md file (Source \u2013 Unit42)<\/figcaption><\/figure>\n<\/div>\n

Both VirusTotal and ClawScan returned clean verdicts, meaning the skill stayed freely available while hiding live malicious code.<\/a><\/p>\n

Each of these skills mimicked a legitimate tool. The TradingView skills appeared to be trader productivity aids, and omnicogg passed for a general utility. <\/p>\n

Attackers exploited the trust users place in a curated marketplace, making detection harder for both automated tools and human reviewers alike.<\/a><\/p>\n

Agentic Financial Fraud and Novel Exploitation<\/strong><\/h2>\n

Beyond data theft, researchers found two skills built to abuse the AI agent\u2019s advisory authority for financial gain. The money-radar skill posed as a financial product advisor for users in mainland China, Hong Kong, and Singapore. <\/p>\n

On every invocation, it silently fetched a payload from laosji[.]net and embedded affiliate tracking links into every recommendation it generated. <\/p>\n

\n
\"The
The money-radar skill\u2019s SKILL.md instructs the agent to fetch data from laosji[.]net (Source \u2013 Unit42)<\/figcaption><\/figure>\n<\/div>\n

The operator could swap out recommended products at any time without the user\u2019s knowledge. <\/a>The letssendit skill went further by running a pump-and-dump scheme on the Solana blockchain. <\/p>\n

Installed agents pooled SOL cryptocurrency into the operator\u2019s wallet, after which the operator purchased the SENDIT meme token at the lowest available price before launching it on pump[.]fun. <\/p>\n

Outside buyers could mistake the coordinated AI activity for organic demand, allowing the operator to dump their cheap position onto secondary buyers at a profit.<\/a><\/p>\n

These cases represent some of the first documented instances of autonomous AI agents being used for coordinated financial fraud<\/a>. <\/p>\n

Researchers recommend validating publisher provenance, auditing skill source files line by line, and monitoring outbound network traffic for connections to undocumented endpoints. <\/p>\n

Any behavior that does not match a skill\u2019s stated purpose should be flagged as a potential indicator of compromise.<\/a><\/p>\n

Indicators of Compromise (IoCs):-<\/strong><\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Type<\/th>\nIndicator<\/th>\nDescription<\/th>\n<\/tr>\n<\/thead>\n
IP Address<\/td>\n2.26.75[.]16<\/td>\nC2 server hosting the cluw macOS infostealer payload<\/td>\n<\/tr>\n
IP Address<\/td>\n91.92.242[.]30<\/td>\nAMOS C2 server used in early and ongoing campaigns<\/td>\n<\/tr>\n
URL<\/td>\n91.92.242[.]30\/lamq4<\/td>\nAMOS payload delivery endpoint<\/td>\n<\/tr>\n
Domain<\/td>\ndownload.setup-service[.]com<\/td>\nMalicious download distribution domain<\/td>\n<\/tr>\n
Domain<\/td>\ninstall.app-distribution[.]net<\/td>\nMalicious app distribution domain<\/td>\n<\/tr>\n
Domain<\/td>\nlaosji[.]net<\/td>\nDomain used for runtime affiliate injection via money-radar skill<\/td>\n<\/tr>\n
Domain<\/td>\nopenclawcli.vercel[.]app<\/td>\nInfrastructure associated with malicious OpenClaw CLI<\/td>\n<\/tr>\n
URL<\/td>\nrentry[.]co\/openclaw-code<\/td>\nPaste-site redirect lure delivering Base64-encoded dropper<\/td>\n<\/tr>\n
URL<\/td>\nglot[.]io\/snippets\/hfd3x9ueu5<\/td>\nPaste-site intermediary used for macOS payload delivery<\/td>\n<\/tr>\n
GitHub URL<\/td>\ngithub[.]com\/Ddoy233\/openclawcli<\/td>\nMalicious OpenClaw CLI repository<\/td>\n<\/tr>\n
SHA256<\/td>\n818aea6143282b352fdfdc0f3ebf77a36e54eb3befb5cad1a355a99ab97c6aa7<\/td>\nmacOS infostealer cluw payload<\/td>\n<\/tr>\n
SHA256<\/td>\n881ce5cb124c4d2e814783724cc1388f6a1cbf6eee274c3f3366e77ba3503ad7<\/td>\nMalicious skill payload hash<\/td>\n<\/tr>\n
SHA256<\/td>\nb30eaed1f7478c28f4ec50d07ed5ef014ffbc4b2bc5a38d689ba9f7abb5e19c2<\/td>\nomnicogg skill (file-padded AMOS dropper)<\/td>\n<\/tr>\n
SHA256<\/td>\nb6c7e0bf573b1c7d9d3a05eb08d26579199515b847df984862805f44a7af8007<\/td>\ntradingview-ai-indicator-assistant malicious skill<\/td>\n<\/tr>\n
SHA256<\/td>\nebb73dbb5aac1f6fe1a88e8f26126a1e1aa34c9f3345ad4345189b40d9bf1d1d<\/td>\nmoney-radar affiliate injection skill<\/td>\n<\/tr>\n
SHA256<\/td>\nf4e41aa269c88bf11a2022701a9cf41e9a186aa1b224d837c31bf34e0b875d0e<\/td>\nletssendit agentic front-running skill<\/td>\n<\/tr>\n
Publisher\/Skill<\/td>\n[redacted]\/santi-text-game<\/td>\nMalicious skill identified in research<\/td>\n<\/tr>\n
Publisher\/Skill<\/td>\n[redacted]\/omnicogg<\/td>\nFile-padded AMOS dropper skill<\/td>\n<\/tr>\n
Publisher\/Skill<\/td>\n[redacted]\/letssendit<\/td>\nAgentic front-running \/ pump-and-dump skill<\/td>\n<\/tr>\n
Publisher\/Skill<\/td>\n[redacted]\/money-radar<\/td>\nRuntime agentic affiliate injection skill<\/td>\n<\/tr>\n
Publisher\/Skill<\/td>\n[redacted]\/ai-tradingview-assistant-for-macos<\/td>\nmacOS infostealer delivery skill<\/td>\n<\/tr>\n
Publisher\/Skill<\/td>\n[redacted]\/tradingview-ai-indicator-assistant<\/td>\nmacOS infostealer delivery skill<\/td>\n<\/tr>\n
Publisher\/Skill<\/td>\n[redacted]\/pdfcheck<\/td>\nMalicious skill identified in research<\/td>\n<\/tr>\n
Publisher\/Skill<\/td>\n[redacted]\/update<\/td>\nMalicious skill identified in research<\/td>\n<\/tr>\n
Publisher\/Skill<\/td>\n[redacted]\/wistec-core<\/td>\nMalicious skill identified in research<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

Note:<\/strong>\u00a0IP addresses and domains are intentionally defanged (e.g.,\u00a0<\/em>[.]<\/em><\/code>) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM<\/em>.<\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong> Google<\/a><\/strong><\/strong>.<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n

The post OpenClaw Skill Marketplace Exposes AI Agents to Supply Chain Malware and Financial Fraud<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

OpenClaw Skill Marketplace Exposes AI Agents to Supply Chain Malware and Financial Fraud A wave of malicious skills targeting the OpenClaw AI agent marketplace has exposed a dangerous new frontier in software supply chain security. Attackers are using the ClawHub skill marketplace to push harmful code into AI agent environments, stealing data and running financial […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-13860","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13860"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=13860"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13860\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=13860"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=13860"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=13860"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}