Poisoned Pipeline / Incidents / AS53
Malicious ClawHub / OpenClaw skills
OpenSourceMalware reviewed ClawHub (then ClawdBot / MoltBot, now
OpenClaw) and found 386 malicious skills. 28 published 27–29 Jan 2026
targeting Claude Code and Moltbot; 386 more 31 Jan–2 Feb. Skills posed
as crypto-trading automation and delivered infostealers (exchange API
keys, wallet keys, SSH, browser passwords) on macOS and Windows. Shared
C2 91.92.242.30. No exploit — social engineering plus an unreviewed
skills registry.
Mapped techniques
- T0210 Poison AI coding-agent config or workspace
- T0110 Advertise malicious artifact
- T0109 Publish malicious artifact
- T0184 Harvesting sensitive information from files
supply-chain ClawHub registry
Skills are a new dependency layer with no lockfile or malware scan.
Professionally documented crypto-trading skills on the official hub.
386 malicious skills in days.
Wallet keys, SSH, browser passwords.