A malware campaign targeted ClawHub, the official repository for OpenClaw AI agent “skills,” by using fake troubleshooting tips to distribute the Atomic macOS (AMOS) infostealer.

The Infection Method

Unlike standard supply chain attacks that poison source code, this campaign leveraged social engineering within the repository’s interactive elements:

• Malicious Comments: Threat actors posted fake troubleshooting suggestions on popular, legitimate skills.
• Deceptive Instructions: Comments or “Prerequisites” sections instructed users to run specific commands to “fix” compatibility issues.
• The Payload: These commands contained Base64-encoded strings that downloaded a shellcode loader from a malicious IP.
• Bypassing Security: Because the malware was hidden in comments rather than the skill package itself, it bypassed the platform’s automated scanners, as detailed in reports from The Register.

Impact and Targets

The primary goal was the exfiltration of sensitive data from high-value AI agent environments:

• Targeted Data: The malware exfiltrated OpenClaw configuration files, API keys, crypto wallet private keys, and browser-stored passwords.
• “Soul” Theft: According to analysis by SentinelOne, attackers stole agent “soul” files, which could allow them to impersonate a user’s AI persona.
• Affected Platforms: The campaign specifically delivered the macOS-focused AMOS infostealer.