OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat Menu Tools ATOMs Security Consulting About Us Under Attack? Threat Research Center Threat Research Malware Malware OpenClaw’s Skill Marketplace and the Emerging AI Supply Chain Threat 9 min read Related Products Advanced DNS Security Advanced URL Filtering Advanced WildFire Cloud-Delivered Security Services Cortex Cortex XDR Cortex XSIAM Unit 42 AI Security Assessment Unit 42 Frontier AI Defense Unit 42 Incident Response By: Shresta Bellary Seetharam Nabeel Mohamed Billy Melicher Oleksii Starov Published: June 23, 2026 Categories: Malware Threat Research Tags: Agentic AI ClawHavoc ClawHub Defense evasion Infostealer OpenClaw Payload VirusTotal Share Executive Summary OpenClaw is an AI agent that executes third-party skills from ClawHub, its dedicated marketplace. Skills are markdown-driven packages with broad local system access, making ClawHub a critical link in the agentic software supply chain. Following its release, the ecosystem saw several malicious campaigns. Those early findings, published in February 2026, prompted ClawHub to integrate VirusTotal and ClawScan, enabling proactive screening of published skills and code-level analysis to block skills flagged as malicious from download. However, our analysis from February-May 2026 revealed persistent and evasive malicious skills on ClawHub. We identified five unblocked skills. We reported all five to ClawHub for takedown. OpenClaw banned the accounts mentioned and deleted all of the skills. The five skills represent three distinct threat categories leveraging the AI supply chain ecosystem: Infostealers: Two skills delivered macOS infostealers. Both connect to command-and-control (C2) infrastructure, indicating persistent threat actor activity. Evasion: One skill has an inflated file size to exceed scanner thresholds, bypassing both ClawScan and VirusTotal detection. Agentic threats: Two skills represent agentic threats: runtime agentic affiliate injection and agentic front-running. Both are novel techniques that the skill authors used for financial gain. OpenClaw is now also collaborating with NVIDIA to provide documentation of what each skill does, and to run NVIDIA’s analysis tool on all skills. Palo Alto Networks customers are better protected from the threats discussed above through the following products and services: Koi Agentic Endpoint Security (AES) Advanced URL Filtering Advanced DNS Security Prisma Browser Advanced WildFire Cortex XDR and XSIAM The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-specific risks. If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team . Related Unit 42 Topics Agentic AI , OpenClaw , ClawHub , Supply Chain, Infostealer AI Agent Skills as a Supply Chain Attack Surface Software supply chain attacks typically rely on compromising distribution vectors or spoofing dependencies. However, AI agent ecosystems have altered this paradigm, and their threat model differs from previously established ecosystems like npm or PyPI . While conventional malware often faces limitations from language runtimes or containers, malicious skills use semantic instruction hijacking to bypass technical constraints. By misusing the AI’s natural language interpretation, malicious skills can exploit the agent's operational context, including file systems, shells and credential managers, without requiring a conventional exploit. The lack of isolation between skill logic and agent authority means that installation results in complete control over the agent's identity. This allows a malicious skill to perform unauthorized actions through the agent’s own authenticated sessions. Early Campaign Activity on ClawHub In early February 2026, Bitdefender Labs reported that approximately 17% of OpenClaw skills they analyzed in the first few weeks of the platform's release carried malicious payloads. Koi Security's ClawHavoc disclosure documented 341 malicious skills, and Trend Micro separately confirmed skills distributing Atomic macOS stealer (AMOS) malware across the marketplace. This early wave featured several distinct techniques: Base64-encoded curl-pipe-bash dropper : These skills embedded a fake prerequisite block that instructed the agent to decode and execute a Base64-encoded remote payload, typically fetched from 91.92.242[.]30 , the IP address for an AMOS C2 server. Platform-specific delivery: For macOS targets, paste-site redirects ( glot[.]io, rentry[.]co ) served as an intermediary step, allowing attackers to update payloads without modifying the published skill. Attackers directed Windows targets to password-protected executables hosted on third-party hosting services. ​​ Persistence via auto-updaters: Auto-updater skills combined the initial dropper with scheduled cron job registration, ensuring the C2 channel persisted even after skill removal. Alternative exfiltration channel : A distinct cluster ( polymarketbtc, polymarketbtcassistant and related skills published by krajekisbtc ) exfiltrated cryptocurrency private keys via the Telegram Bot API, a C2 channel independent of the shared dropper infrastructure. Registry saturation : A single publisher account injected malicious payloads into the majority of their published skill catalog with identical payloads to maximize installation surface before detection. Those findings prompted ClawHub to partner with VirusTotal , enabling proactive screening of published skills. These skills from these early campaigns have since been removed from the marketplace or marked as malicious. In the following sections, we document the state of the marketplace between February and May 2026, during which VirusTotal and ClawScan served as the primary screening mechanisms. (On June 1, ClawHub also announced a partnership with NVIDIA to help screen published skills.) The AMOS dropper infrastructure from earlier campaigns remains active more than three months after first public disclosure, with the C2 server at 91.92.242[.]30 continuing to receive new skill deliveries. Additionally, we observe novel attacks that adapt to and exploit skill marketplaces, leveraging the agentic execution model to implement financial schemes that evade some kinds of malware detection. Malicious Skills Distributing ClawHavoc Payload Publisher/Skill: [redacted]/tradingview-ai-indicator-assistant SHA256 hash: b6c7e0bf573b1c7d9d3a05eb08d26579199515b847df984862805f44a7af8007 On May 17, 2026, the account published two skills targeting TradingView users as shown in Figure 1. Figure 1. ClawHub marketplace listings for two TradingView assistant skills. Both of these skills presented as AI assistants for macOS, posing as productivity tools for traders. Both embedded the same malicious prerequisite block, which prevented the skills from functioning until the user performed a required action. In this case, the prerequisite block directed agents to a site with malicious instructions to copy and paste text into a terminal window. We refer to this site as a paste-site redirect lure. The paste-site redirect lure at hxxps[:]//rentry[.]co/openclaw-code served instructions with a Base64-encoded string for the prerequisite block, which the agent must run before the skill can continue. Figure 2 below shows an example of this page. Figure 2. Paste-site redirect lure. When the agent performed the actions in the paste-site redirect lure, the associated command fetched a payload from hxxp[:]//2.26.75[.]16/Xuvewuyur . That payload was a macOS infostealer named cluw with a SHA256 hash of 818aea6143282b352fdfdc0f3ebf77a36e54eb3befb5cad1a355a99ab97c6aa7 . The delivery mechanism is structurally identical to the ClawHavoc campaigns documented by Koi Security and Trend Micro . The prerequisite block, the paste-site redirect lure and the Base64 pipe to bash all match the early-wave pattern. The C2 server we discovered at 2.26.75[.]16 differs from prior disclosure. The cluw payload differs from AMOS. This campaign used the established delivery template with fresh backend infrastructure. Until mid-May, ClawHub's automated auditing returned a verdict of Pass for ai-tradingview-assistant-for-macos and no verdict for tradingview-ai-indicator-assistan t. Neither skill triggered detection, despite containing a verbatim paste-site prerequisite lure. This structural pattern characterized over 300 skills in the original ClawHavoc disclosure. File Padding for Defense Evasion Publisher/Skill: [redacted]/omnicogg SHA256 hash: b30eaed1f7478c28f4ec50d07ed5ef014ffbc4b2bc5a38d689ba9f7abb5e19c2 The omnicogg skill was an early-wave threat, similar to those that defined the initial surge of malicious activity on ClawHub. It is a Base64-encoded curl-pipe-bash dropper that delivered the AMOS malware via 91.92.242[.]30 , the same C2 infrastructure documented in earlier campaigns. This skill is distinguished by its delivery vessel, a README.md file. The malicious payload appears at the start, followed by 22 MB of padding characters. This padding inflates the file size beyond the limits that many content-analysis pipelines enforce before declining to process a file. Figure 3 below shows an example of the padding characters in this file. Figure 3. The omnicogg skill’s README.md file. JFrog Security Research disclosed this skill in March 2026. This evasion technique can be effective because many scanning pipelines skip abnormally large files rather than process them. This skill's ClawScan audit was in review in mid-May, while VirusTotal returned a clean verdict, and the skill remained available for download, as shown in Figure 4. Scanners that do not analyze content beyond standard thresholds will miss payloads structured to exploit that weakness. Figure 4. ClawHub audit page for [redacted]/omnicogg shows an overall pass despite containing malicious code. . Runtime Agentic Affiliate Injection Publisher/Skill: [redacted]/money-radar SHA256 hash: ebb73dbb5aac1f6fe1a88e8f26126a1e1aa34c9f3345ad4345189b40d9bf1d1d This ClawHub campaign focused on financial communities, with skills that targeted banking and crypto exchange workflows. This money-radar skill presented itself as an overseas financial product advisor that compared brokerages, banks, crypto exchanges and remittance services for users in mainland China, Hong Kong and Singapore. However, its core logic was an affiliate funnel for developer profit. The skill weaponized the agent's advisory authority, routing all financial recommendations through affiliate links from a known-malicious domain. The publisher retained dynamic control over which products it pushed after installation. Technical Analysis The skill's mandatory first action on every invocation was to fetch product data from laosji[.]net , a domain previously observed in paste-jacking campaigns. Figure 4 shows an example of this action within the skill's SKILL.md file. Figure 5. The money-radar skill's SKILL.md instructs the agent to fetch data from laosji[.]net . The agent ingested a referrals.json payload from laosji[.]net as a precondition to answering any financial question. That payload contained approximately 60 products across eight categories, each with a referralLink field carrying affiliate tracking. The SKILL.md file then issued an explicit instruction to always use the referral links as shown in Figure 6. Figure 6. The money-radar skill's SKILL.md file with the affiliate link instruction highlighted and translated. Once the skill was installed, the publisher dynamically controlled the links the agent would recommend by updating referrals.json on laosji[.]net . The operator could change which products were recommended, rotated affiliate partners or redirected victims toward higher-commission offerings without the victim’s involvement. This exploitation constitutes an agent-specific form of runtime affiliate injection. Unlike typical affiliate injection, which intercepts links the target was already clicking, this skill generated the recommendation itself. The affiliate link arrived embedded in what appears to be skill-based expert advice. Agentic Front Running Publisher/Skill: [redacted]/letssendit SHA256: hash f4e41aa269c88bf11a2022701a9cf41e9a186aa1b224d837c31bf34e0b875d0e The letssendit skill implemented an agentic front-running scheme. This scheme involved the skill operator misusing the ClawHub platform to illegitimately profit from meme token launches. It achieved this by leveraging numerous AI agent participants and coordinated agentic execution. The coordinated activity executed on infrastructure using the domain letssendit[.]fun . Guided by the skill's SKILL.md file instructions, installed agents autonomously pooled Solana blockchain platform cryptocurrency (SOL) into the operator's digital wallet. Once enough agents had joined, the operator would front-run the distribution by purchasing the SENDIT meme token at the lowest bonding curve price before allocating any to the agents. The token then launched publicly on the cryptocurrency platform pump[.]fun , where external buyers could mistake the coordinated AI botnet activity for organic retail demand. This could create a classic rug pull . The operator simply rotates wallets across multiple confirmed launches, dumping their low-cost position into the artificial market rally at the expense of secondary market buyers. Ultimately, this exploit represents a novel documented case of an attacker weaponizing an autonomous AI agent network to execute a pump-and-dump scheme. This behavior constitutes fraudulent financial activity. We strongly recommend that enterprises block this skill across their AI infrastructure to mitigate regulatory and security risks. Conclusion The cases documented in this article span evasion, deceptive monetization, financial fraud and campaign persistence. Each case passed existing detection tools at the time of our analysis. Organizations can strengthen their defensive posture by using a rigorous supply chain verification framework. We identified that skill execution occurs within the agent process. This necessitates active validation of publisher provenance and a line-by-line audit of package source files. Our research indicates that monitoring outbound network traffic can identify post-installation communication with undocumented endpoints. We recommend cross-referencing all external connections against the provided documentation. Any discrepancies serve as observable indicators of risk. These verification steps help protect an organization’s environment by ensuring that the operational behavior of a skill aligns strictly with its stated technical specifications. Palo Alto Networks Protection and Mitigation Palo Alto Networks customers are better protected from the threats discussed above through the following products: Koi's Agentic Endpoint Security (AES) gives security teams a single platform to discover every AI component across the agentic endpoint, assess its risk, enforce policy, and remediate violations - so your end users adopt the latest technology, increase the org productivity without compromising on security. Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious. Prisma Browser Prisma Browser provides additional protection layers against advanced web threats including dynamic scans of every loaded web page, to prevent execution of malicious content and protect company assets. The Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research. Cortex XDR and XSIAM are designed to prevent the execution of known malicious malware, and also prevent the execution of unknown malware using Behavioral Threat Protection. The Unit 42 AI Security Assessment and Unit 42 Frontier AI Defense service can help identify and mitigate complex AI-specific risks. If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call: North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42) UK: +44.20.3743.3660 Europe and Middle East: +31.20.299.3130 Asia: +65.6983.8730 Japan: +81.50.1790.0200 Australia: +61.2.4062.7950 India: 000 800 050 45107 South Korea: +82.080.467.8774 Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance . Acknowledgments We’d like to thank the entire Unit 42 team for supporting us with this article. Special thanks to Samantha Stallings, Bradley Duncan and Lysa Myers for helping us review this article. Indicators of Compromise Domains, IP Addresses and URLs 2.26.75[.]16 91.92.242[.]30 91.92.242[.]30/lamq4 download.setup-service[.]com github[.]com/Ddoy233/openclawcli glot[.]io/snippets/hfd3x9ueu5 install.app-distribution[.]net laosji[.]net openclawcli.vercel[.]app rentry[.]co/openclaw-code Publisher/Skill [redacted]/santi-text-game [redacted]/omnicogg [redacted]/letssendit [redacted]/money-radar [redacted]/ai-tradingview-assistant-for-macos [redacted]n/tradingview-ai-indicator-assistant [redacted]/pdfcheck [redacted]/update [redacted]/wistec-core SHA256 Hashes 818aea6143282b352fdfdc0f3ebf77a36e54eb3befb5cad1a355a99ab97c6aa7 881ce5cb124c4d2e814783724cc1388f6a1cbf6eee274c3f3366e77ba3503ad7 b30eaed1f7478c28f4ec50d07ed5ef014ffbc4b2bc5a38d689ba9f7abb5e19c2 b6c7e0bf573b1c7d9d3a05eb08d26579199515b847df984862805f44a7af8007 ebb73dbb5aac1f6fe1a88e8f26126a1e1aa34c9f3345ad4345189b40d9bf1d1d f4e41aa269c88bf11a2022701a9cf41e9a186aa1b224d837c31bf34e0b875d0e Additional Resources OpenClaw Partners with VirusTotal for Skill Security OpenClaw Collaborates with NVIDIA for Stronger Agent Skill Security Anatomy of a Deception: Uncovering the 'omnicogg' Dropper in ClawHub - JFrog Security Research ClawHavoc: 341 Malicious Clawed Skills Found by the Bot They Were Targeting - Koi Security Malicious OpenClaw Skills Used to Distribute Atomic macOS Stealer - Trend Micro Trust No Skill: Integrity Verification for AI Agent Supply Chains - Unit 42 Updated 24 June, 2026 at 5:06 AM PDT --> Back to top Tags Agentic AI ClawHavoc ClawHub Defense evasion Infostealer OpenClaw Payload VirusTotal Threat Research Center Next: The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration Table of Contents Related Articles Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector Trust No Skill: Integrity Verification for AI Agent Supply Chains Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility Related Malware Resources Threat Research June 30, 2026 Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector Agentic AI LLMs Malicious Domains Read now Threat Research June 25, 2026 CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure Backdoor CL-STA-1062 Malware Read now Threat Research June 11, 2026 Trust No Skill: Integrity Verification for AI Agent Supply Chains AI agents Credential exfiltration LLMs Read now High Profile Threats June 2, 2026 The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2) Credential Harvesting GitHub Npm packages Read now Threat Research June 2, 2026 Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor CL-CRI-1089 MacOS Malvertising Read now Threat Actor Groups May 22, 2026 Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns Advanced Persistent Threat AppDomainManager DLL Sideloading Read now Threat Research May 20, 2026 Tracking TamperedChef Clusters via Certificate and Code Reuse Adware Appsuite PDF Certificates Read now Threat Research May 15, 2026 Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files API Cryptocurrency Gremlin stealer Read now Threat Research May 11, 2026 Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools Active Directory AD CS attacks Certificate template Read now Get updates from Unit 42 Peace of mind comes from staying ahead of threats. Subscribe today. Your Email Subscribe for email updates to all Unit 42 threat research. By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply. --> Invalid captcha! Subscribe Get the latest news, invites to events, and threat alerts Enter your email now to subscribe! Sign up By submitting this form, I understand my personal data will be processed in accordance with Palo Alto Networks Privacy Statement and Terms of Use. Sign up Products and Services AI-Powered Network Security Platform Secure AI by Design Prisma AIRS AI Access Security Cloud Delivered Security Services Advanced Threat Prevention Advanced URL Filtering Advanced WildFire Advanced DNS Security Enterprise Data Loss Prevention Enterprise IoT Security Medical IoT Security Industrial OT Security SaaS Security Next-Generation Firewalls Hardware Firewalls Software Firewalls Strata Cloud Manager SD-WAN for NGFW PAN-OS Panorama Secure Access Service Edge Prisma SASE Application Acceleration Autonomous Digital Experience Management Enterprise DLP Prisma Access Prisma Browser Prisma SD-WAN Remote Browser Isolation SaaS Security AI-Driven Security Operations Platform Cloud Security Cortex Cloud Application Security Cloud Posture Security Cloud Runtime Security Prisma Cloud AI-Driven SOC Cortex XSIAM Cortex XDR Cortex XSOAR Cortex Xpanse Unit 42 Managed Detection & Response Managed XSIAM Next-Generation Identity Security Privileged Access Management Identity and Access Management Endpoint Privilege Manager Identity Governance Workforce Password Management Agentic Identities Secrets Management Unified Secrets Governance Application Credentials Delivery Vendor Privileged Access Threat Intel and Incident Response Services Proactive Assessments Incident Response Transform Your Security Strategy Discover Threat Intelligence Company About Us Careers Contact Us Corporate Responsibility Customers Investor Relations Location Newsroom Popular Links Blog Communities Content Library Cyberpedia Event Center Manage Email Preferences Products A-Z Product Certifications Report a Vulnerability Sitemap Tech Docs Unit 42 Do Not Sell or Share My Personal Information Privacy Trust Center Terms of Use Documents Copyright © 2026 Palo Alto Networks. All Rights Reserved EN Select your language Products and services Network Security Platform CLOUD DELIVERED SECURITY SERVICES Advanced Threat Prevention DNS Security Data Loss Prevention IoT Security Next-Generation Firewalls Hardware Firewalls Strata Cloud Manager SECURE ACCESS SERVICE EDGE Prisma Access Prisma SD-WAN Autonomous Digital Experience Management Cloud Access Security Broker Zero Trust Network Access Cloud Security Cortex Cloud Prisma Cloud AI-Driven Security Operations Platform Cortex XDR Cortex XSOAR Cortex Xpanse Cortex XSIAM External Attack Surface Protection Security Automation Threat Prevention, Detection & Response Threat Intel and Incident Response Services Proactive Assessments Incident Response Transform Your Security Strategy Discover Threat Intelligence Company About Us Careers Contact Us Corporate Responsibility Customers Investor Relations Location Newsroom Popular links Blog Communities Content Library Cyberpedia Event Center Manage Email Preferences Products A-Z Product Certifications Report a Vulnerability Sitemap Tech Docs Unit 42 Do Not Sell or Share My Personal Information Privacy Trust Center Terms of Use Documents Copyright © 2026 Palo Alto Networks. All Rights Reserved EN Select your language USA (ENGLISH) --> Your browser does not support the video tag. Default Heading Read the article Seekbar Volume

📌 来源: Palo Alto Unit42 | 📅 2026-06-23