Threat Research · unit42.paloaltonetworks.com

Unit 42 Finds Malicious OpenClaw Skills Evading Scanners and Abusing AI Agents

Jun 24, 2026 · Original article ↗

Summary

Unit 42 identified five malicious ClawHub skills that delivered macOS infostealers, bypassed scanners with 22 MB of file padding, or abused agents for affiliate manipulation and token front-running. OpenClaw removed the skills and banned accounts.

Key points

OpenClaw skills can use an agent’s access to local files, shells, and credentials to carry out actions through its authenticated sessions.
Unit 42 found five malicious skills on ClawHub between February and May 2026, despite screening with VirusTotal and ClawScan; OpenClaw removed them and banned associated accounts.
Two skills delivered macOS infostealers using deceptive prerequisite instructions and remote payloads; one payload was identified as cluw.
The omnicogg skill padded its README.md file with 22 MB of data to exceed scanner processing thresholds.
The money-radar skill fetched product and referral data from laosji[.]net and directed agents to recommend operator-controlled affiliate links.
The letssendit skill coordinated agents to pool SOL and buy a meme token before its public launch, in a scheme Unit 42 characterized as agentic front-running.
The article recommends verifying skill publishers, auditing package source files, and monitoring outbound network traffic.

Article Details

Attack Vectors: Malicious ClawHub skills disguised as productivity or financial tools used prerequisite instructions to direct agents to paste-site content and execute Base64-encoded payloads through a terminal.
A malicious skill delivered a macOS infostealer after fetching its payload from remote infrastructure.
An auto-updater skill registered cron jobs to preserve C2 communication.
A skill padded its README.md with 22 MB of characters to evade scanners that skip oversized files.
A financial-advisor skill fetched remotely controlled referral data and instructed the agent to use affiliate links in recommendations.
A skill coordinated AI agents to pool cryptocurrency for an operator's meme-token purchase and subsequent sale.
Defensive Notes: Verify skill publisher provenance and audit package source files before installation.
Monitor outbound network traffic and compare external connections against each skill's documented behavior.
Use skill screening and analysis tools, while accounting for oversized files that may evade content-analysis thresholds.
Block the letssendit skill across enterprise AI infrastructure, as recommended in the article.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`download[.]setup-service[.]com`	Listed in the article's domains, IP addresses, and URLs associated with the reported activity.
DOMAIN	`install[.]app-distribution[.]net`	Listed in the article's domains, IP addresses, and URLs associated with the reported activity.
DOMAIN	`laosji[.]net`	Domain identified as previously observed in paste-jacking campaigns and used to serve remotely controlled affiliate referral data.
HOSTNAME	`openclawcli[.]vercel[.]app`	Hostname listed among indicators associated with the reported activity.
IPV4	`2[.]26[.]75[.]16`	C2 and payload infrastructure used to deliver the cluw macOS infostealer.
IPV4	`91[.]92[.]242[.]30`	C2 server associated with AMOS delivery; the article reports it continued receiving new skill deliveries.
SHA256	`818aea6143282b352fdfdc0f3ebf77a36e54eb3befb5cad1a355a99ab97c6aa7`	Hash of the cluw macOS infostealer payload.
SHA256	`881ce5cb124c4d2e814783724cc1388f6a1cbf6eee274c3f3366e77ba3503ad7`	Listed among the article's hashes for malicious skills and payloads.
SHA256	`b30eaed1f7478c28f4ec50d07ed5ef014ffbc4b2bc5a38d689ba9f7abb5e19c2`	Hash of the omnicogg skill, which delivered AMOS and used file padding to evade scanning.
SHA256	`b6c7e0bf573b1c7d9d3a05eb08d26579199515b847df984862805f44a7af8007`	Hash of the malicious TradingView-assistant skill package described in the article.
SHA256	`ebb73dbb5aac1f6fe1a88e8f26126a1e1aa34c9f3345ad4345189b40d9bf1d1d`	Hash of the money-radar skill that fetched attacker-controlled affiliate referral data.
SHA256	`f4e41aa269c88bf11a2022701a9cf41e9a186aa1b224d837c31bf34e0b875d0e`	Hash listed for the letssendit skill used in the agentic front-running scheme.
URL	`hxxps[:]//rentry[.]co/openclaw-code`	Paste-site redirect lure that supplied malicious instructions for the skill's prerequisite.