Skip to content
Ironheights
CampaignStatus unknownCoverage: Partly coveredPrimary source

Malicious ClawHub skills targeting crypto and trading users

Reported by OpenSourceMalware (Paul McCarty) on . Names, numbers, and dates are as the sources state them.

What it did

Reported 28 malicious skills published 27–29 January and a second group of 386 published 31 January–2 February, posing as crypto-trading and social-media tools. All shared the same command-and-control address and used social engineering to get users to run commands that stole exchange API keys, wallet keys, SSH credentials and browser passwords. The Hacker News reports this as the same activity Koi named ClawHavoc.

Skill names as reported

  • polymarket-traiding-bot
  • reddit-trends
  • base-agent
  • bybit-agent
  • axiom-agent

Examples from the report's timeline.

Techniques

  • Fake prerequisite
  • Encoded command
  • Download piped to shell
  • Password-protected archive
  • Infostealer

Status, as stated by the source

At publication the report said most of these skills were still in the openclaw/skills GitHub repository. No skill-specific status found. Unit 42 (23 June 2026) says skills from the early campaigns were “removed from the marketplace or marked as malicious”, which does not say which.

We do not check the registry ourselves. “Unknown” means no source we found says the skill was removed.

Would Ironheights flag this pattern?

Partly covered

Same delivery pattern as ClawHavoc: the inline decode-and-run line is flagged; a link to an archive on GitHub is not.

Rules that fire on a harmless, synthetic copy of the reported pattern. We did not scan the original malware, and a rule firing on the pattern is not a promise about every variant.

Sources

  1. Malicious ClawHub Skills Target OpenClaw Users(opens in a new tab)OpenSourceMalware · primary
  2. Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users(opens in a new tab)The Hacker News · secondary

Sources are the only outbound links on this page. We never link to the skills themselves or publish their payloads.

Rules that look at neighbouring patterns. They are listed for reading, not as coverage of this entry.