Affected Systems

ClawHub marketplace users consuming third-party AI skills. Specific affected products: OpenClaw and ClawHub platforms. Scope includes organizations deploying AI agents with marketplace-sourced skills that may contain evasive malware delivering infostealers and financial fraud capabilities.

Exploitation Status

Active exploitation confirmed. Unit 42 identified malicious skills already present in ClawHub marketplace that successfully evade automated security scanners. Threat actors are actively distributing compromised AI skills through the platform.

Business Impact

Organizations using ClawHub marketplace skills face risk of infostealer deployment and financial fraud through compromised AI agents. Automated security controls are ineffective against these evasive techniques. No CVE assigned, limiting visibility in traditional vulnerability management workflows. This represents a novel supply chain attack vector targeting AI/ML infrastructure that may bypass existing security controls.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Audit all AI skills sourced from ClawHub marketplace; suspend untrusted or unverified skills until validation complete
  • Implement manual code review for all third-party AI skills before deployment, focusing on obfuscation and external network calls
  • Monitor AI agent runtime behavior for unexpected network connections, credential access, or financial transaction attempts
  • Contact ClawHub and OpenClaw vendors for official guidance on identifying and removing malicious skills from your environment
  • Establish allow-list policy for AI marketplace skills; require vendor attestation and security review before production use

---

# Threat Actor Context

Actor Profile

OpenClaw is a threat actor identified by Unit 42 that leverages AI marketplace infrastructure to distribute malicious capabilities. The actor exploits the ClawHub marketplace platform to deploy compromised AI skills that bypass automated security scanners. OpenClaw's motivation appears to be financially driven, focusing on information theft and automated financial fraud through agentic AI capabilities. This represents a novel threat vector exploiting the emerging AI supply chain ecosystem, where trust in marketplace-distributed AI components is weaponized for malicious purposes.

TTPs (Tactics, Techniques, Procedures)

OpenClaw employs supply chain compromise tactics by embedding malicious code within AI skills distributed through the ClawHub marketplace. The actor demonstrates evasion capabilities designed to bypass automated security scanning mechanisms, suggesting sophisticated OPSEC and knowledge of marketplace security controls. Primary payloads include infostealer malware for credential and data exfiltration, alongside agentic financial fraud capabilities that leverage AI automation for fraudulent transactions. The use of trusted marketplace distribution channels indicates T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools) and T1027 (Obfuscated Files or Information) to evade detection. Post-compromise activities align with T1555 (Credentials from Password Stores) and T1005 (Data from Local System) for information theft.

Targets & Patterns

No specific targeted sectors or geographic regions have been identified in the available reporting. The indiscriminate distribution through a public marketplace suggests opportunistic targeting of any organizations or individuals utilizing ClawHub AI skills. The broad availability of compromised skills indicates OpenClaw may be pursuing volume-based targeting rather than focused vertical or regional campaigns. Potential victims include developers, enterprises, and end-users who integrate third-party AI skills from ClawHub into their workflows, making the attack surface extensive across multiple industries that adopt AI marketplace components.

Historical Context

This activity represents an emerging threat pattern in AI supply chain attacks, analogous to traditional software supply chain compromises seen in npm, PyPI, and other package repositories. The OpenClaw campaign marks one of the first documented instances of adversaries weaponizing AI marketplace platforms for malware distribution. This parallels historical supply chain attacks such as the Codecov compromise and malicious Python packages, but adapted for the AI/ML ecosystem. The use of agentic financial fraud capabilities represents a novel evolution, leveraging AI automation for fraud execution rather than just reconnaissance or social engineering.

Defensive Recommendations

  • Implement strict vetting and code review processes for all third-party AI skills before integration, including manual security analysis to detect evasion techniques targeting automated scanners
  • Monitor AI marketplace downloads and skill installations for anomalous behavior, establishing baseline telemetry for legitimate AI component usage patterns
  • Deploy behavioral detection for infostealer indicators including unusual credential access (T1555), file system enumeration (T1005), and abnormal network connections from AI agent processes
  • Establish network segmentation and least-privilege access controls for AI agents and skills to limit lateral movement and data exfiltration opportunities if compromise occurs
  • Maintain software bill of materials (SBOM) for all AI components and skills, enabling rapid identification and removal of compromised marketplace artifacts when threats are disclosed