Malicious OpenClaw Skills Deliver AMOS Stealer and Target Crypto Credentials

Feb 5, 2026 · Original article ↗

Summary

Bitdefender researchers found malicious OpenClaw skills that disguise shell commands, download payloads, and steal credentials. About 17% of skills analyzed in the first week of February 2026 showed malicious behavior.

Key points

Researchers found malicious behavior in about 17% of OpenClaw skills analyzed during the first week of February 2026.
Skills impersonated crypto, social media, productivity, and updater utilities, then ran concealed shell commands to fetch and execute external payloads.
At least three skills delivered AMOS Stealer on macOS; the malware can harvest credentials, browser data, and crypto-related information.
Another skill posed as a sync utility and searched OpenClaw directories for .mykey files, then sent encoded private keys to an attacker-controlled endpoint.
Researchers linked scripts and binaries to IP address 91.92.242.30 and observed use of paste services and impersonating GitHub repositories.
Crypto-focused tools accounted for 54% of the malicious skills identified; social media tools accounted for nearly 24%.
Bitdefender recommends treating skills like software installs, avoiding untrusted external binaries, limiting exposure of secrets, and isolating crypto tools.

Article Details

Attack Vectors: Malicious OpenClaw skills impersonate legitimate utilities and are cloned under slightly varied names to increase visibility and credibility.
Skills execute shell commands, often obfuscated with Base64, to download and run scripts or binaries from external infrastructure.
A malicious skill scans OpenClaw workspace directories for .mykey files, Base64-encodes private keys with file metadata, and sends the data to an attacker-controlled endpoint.
Some skills direct users to download and run external binaries, including AuthTool.exe, or execute separate installation commands.
Malicious skills seek locally stored crypto private keys and API secrets, including credentials exposed through environment variables or command-line arguments.
Defensive Notes: Treat skills as software installations; inspect commands and be wary of skills that download files or request extra tools.
Avoid running external binaries or separate installation commands requested by a skill.
Limit plaintext storage of private keys, API tokens, and wallet credentials; avoid exposing secrets through environment variables where possible.
Verify public repositories and skill publishers; familiar names and repeated listings do not guarantee legitimacy.
Isolate wallet and trading automation in separate environments where possible, and use device security software to detect malware.

Indicators of compromise

Type	Indicator	Context
IPV4	`91[.]92[.]242[.]30`	IP address repeatedly used to host scripts and malware payloads associated with malicious OpenClaw skills.
URL	`hxxp[:]//91[.]92[.]242[.]30/6x8c0trkp4l9uugo`	Payload-delivery URL on infrastructure reported as hosting scripts and malware for malicious OpenClaw skills.
URL	`hxxp[:]//91[.]92[.]242[.]30/dx2w5j5bka6qkwxi`	URL used to download a binary identified in the article as the final AMOS Stealer payload.
URL	`hxxps[:]//github[.]com/Ddoy233/openclawcli`	Specific GitHub repository cited as an example of a repository impersonating OpenClaw tools in the malicious operation.