OpenClaw ClawHub marketplace exploited to distribute macOS stealer malware
Attackers uploaded over 824 malicious skills to the OpenClaw ClawHub registry to distribute the Atomic Stealer (AMOS) malware. The attack manipulated AI agent workflows to trick users into installing malicious payloads via deceptive setup requirements, targeting credentials and other sensitive data.
Attackers shifted from deceiving humans to manipulating AI agentic workflows as trusted intermediaries for malware delivery.
Key facts
- What
- Attackers uploaded over 824 malicious skills to the OpenClaw ClawHub registry to distribute the Atomic Stealer (AMOS) malware.
- Incident date
- Feb 23, 2026
- Who
- OpenClaw
- Failure mode
- Tool Misuse
- AI surface
- Agentic Workflow
- Severity
- Catastrophic
What happened
Attackers uploaded over 824 malicious skills to the OpenClaw ClawHub marketplace that distributed a variant of the Atomic macOS Stealer (AMOS). These skills manipulated AI agents into presenting fake installation requirements to users, tricking them into downloading malware. The campaign targeted sensitive data including Apple and KeePass keychains, browser credentials, and cryptocurrency wallets.
What broke inside the model
- 01 · TriggerAttackers publish malicious skills to the ClawHub marketplace.
- 02 · Model stepAgents and users install them; the skills run with the agent's privileges.
- 03 · Control gapNo code review, signing, or publisher verification stands between the registry and execution.
- 04 · FailureInstalled skills deliver macOS stealer malware.
- 05 · ConsequenceCredentials and wallets are stolen through the agent ecosystem's own supply chain.
The failure occurred due to the absence of a secure supply chain for the skill registry, specifically a lack of code review, code signing, and publisher verification. This allowed attackers to publish arbitrary code that AI agents would then trust and execute or prompt users to install.
What it cost
Sources
- PrimaryMalicious OpenClaw Skills Used to Distribute Atomic macOS Stealertrendmicro.com
- PressResearchers Find 341 Malicious ClawHub Skillsthehackernews.com
- PressAI Coding Agent Horror Stories: Security Risksdocker.com
Cite this entry
https://failureindex.ai/failures/openclaw-clawhub-marketplace-exploited-distribute-macosAI Failure Index. "OpenClaw ClawHub marketplace exploited to distribute macOS stealer malware" (FI-0242). Realm Labs. https://failureindex.ai/failures/openclaw-clawhub-marketplace-exploited-distribute-macos (indexed Jun 5, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0242. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- OmniGuard
- AgentRealm
Realm can inspect a tool call against the user's actual intent before it runs, and hold calls whose arguments or target do not match what was asked, so the wrong tool or the wrong arguments never reach the system of record.