PrivacyHigh
Malicious OpenClaw Skills Reportedly Delivered AMOS Stealer and Exfiltrated Credentials via ClawHub
- Occurred
- Feb 1, 2026
- Published
- Feb 11, 2026
- Source
- AI Incident Database
Summary
Bitdefender researchers reported abuse in OpenClaw's third-party 'skills' ecosystem. In a Feb. 2026 sample, about 17% of skills were reportedly assessed as malicious, with many seemingly cloned under slight name changes. Posing as utilities, some skills were reportedly found to run obfuscated commands, fetch remote payloads, and in some cases deliver AMOS Stealer on macOS. Other skills were reportedly observed searching for private keys or API tokens and exfiltrating them.
Developers
- Malicious actors
- OpenClaw
Deployers
- Unknown threat actors distributing malicious OpenClaw skills
- Unknown threat actors
- Malicious actors
Harmed parties
- Organizations using OpenClaw
- OpenClaw users
- Privacy
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: Malicious skills exfiltrated credentials and private keys, constituting unauthorized data collection and security breach.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8