ClawHavoc Poisons OpenClaw ClawHub with 1,184 Malicious Skills
2 min. read 
Published on
ClawHavoc attackers poisoned OpenClaw’s ClawHub marketplace with 1,184 malicious Skills. These plugins steal data and open backdoors on infected systems. Koi Security named the campaign on February 1, 2026, while Antiy CERT tracks it as TrojanOpenClaw PolySkill family.
Threat actors signed up as developers in late January 2026. They uploaded trojanized Skills disguised as crypto bots and productivity tools. ClawHub’s weak checks let any GitHub account over one week old publish freely.
Access content across the globe at the highest speed rate.
70% of our readers choose Private Internet Access
70% of our readers choose ExpressVPN
Browse the web from multiple devices with industry-standard security protocols.
Faster dedicated servers for specific actions (currently at summer discounts)
By February 5, researchers tied 1,184 bad packages to 12 accounts. One account pushed 677 alone. Even after takedowns, many stayed live with thousands of downloads.
Attack Mechanics
Malicious Skills arrive as ZIP files with hidden payloads in docs or helpers. Attackers mix ClickFix tricks to fool users into running extras. Scripts grab API keys, wallets, and credentials fast.
On macOS, victims pull Atomic Stealer variants. These dump browsers, SSH keys, Telegram data, and Keychains to attacker servers. Reverse shells give remote control.​
AI agents run with high privileges often. This lets plugins hit files, shells, and secrets deeply. ClickFix uses long docs to hide commands from pros too.
Behaviors Table
| Behavior | Description | Risk Level |
|---|---|---|
| ClickFix Downloaders | Trick users to run external binaries as “fixes” | Full system compromise |
| Reverse-Shell Droppers | Connect back to attacker servers for commands | Persistent remote access |
| Data-Stealing Scripts | Exfiltrate credentials and tokens directly | Immediate data loss |
| Password-Protected Payloads | Hidden archives needing manual install | Targeted theft |
Defense Actions
- Audit all installed ClawHub Skills now.
- Delete unknowns and rotate all credentials.
- Block Skills from untrusted publishers.
- Watch for ClickFix in plugin docs.
Exposed OpenClaw instances amplify risks with no auth by default. Teams must govern AI marketplaces better. This hit shows supply chain threats in AI tools clearly.
FAQ
Supply chain attack on ClawHub with 1,184 bad Skills for theft and backdoors. Started late January 2026.
Via ZIP payloads in docs. Use ClickFix to make users run malware manually.
Crypto wallets, browser passwords, API keys, macOS Keychains, SSH, Telegram sessions.
Koi Security on February 1. Antiy CERT analyzed 1,184 packages by February 5.
Remove suspect Skills. Scan endpoints. Change all keys. Check for reverse shells.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages