Acronis Finds 575 Malicious OpenClaw Skills in AI Supply-Chain Attacks
Summary
Acronis TRU reports 575 malicious OpenClaw skills across 13 developer accounts and analyzes trojanized Hugging Face artifacts delivering Windows and macOS payloads, including AMOS Stealer. It details indirect prompt injection, staged execution, evasion and defenses.
Key points
- Acronis TRU identified 575 malicious OpenClaw skills associated with 13 developer accounts; two accounts were responsible for most of the uploads.
- The investigated activity used trojanized skills, models and datasets on ClawHub/OpenClaw and Hugging Face to trick users into installing or executing malicious files.
- The article describes indirect prompt injection as a way to make AI agents carry out hidden instructions, while noting the agents themselves were not compromised.
- Observed payloads targeted Windows and macOS and included trojans, cryptominers and AMOS Stealer.
- The analysis details techniques including obfuscation, staged downloads, removal of Windows Mark-of-the-Web metadata, registry Run-key persistence and in-memory injection into explorer.exe.
- Acronis recommends verifying artifact sources, limiting AI agents’ ability to run arbitrary scripts, monitoring suspicious behavior and blocking malicious repositories.
Article Details
- Attack Vectors
- Trojanized Hugging Face models, datasets, and repositories, and malicious ClawHub skills, distribute or stage payloads.
- Malicious skills use social engineering and indirect prompt injection to persuade users or cause AI agents to execute attacker-provided commands and dependencies.
- Windows and macOS payloads are fetched from external hosts or repositories; observed delivery includes password-protected archives, encoded shell commands, and PowerShell droppers.
- The reported execution chain includes obfuscation, in-memory injection into explorer.exe, registry Run-key persistence, and removal of security metadata.
- The article reports covert command-and-control using web hosts and messaging links.
- Defensive Notes
- Vet AI models, skills, and tools; prefer verified sources and official repositories, and avoid password-protected archives or unverified third-party binaries.
- Restrict AI agents from running arbitrary scripts or spawning processes, and enforce least privilege and application control.
- Monitor for encoded PowerShell, in-memory injection, suspicious outbound HTTPS connections, and other anomalous behavior; use continuous monitoring and proactive threat hunting.
- Monitor AI distribution hubs and block malicious artifacts before they spread.
- Educate users about social engineering and unusual installation instructions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | velvet-parrot[.]com | Domain identified as a C2 server delivering the cryptominer. |
| IPV4 | 91[.]92[.]242[.]30 | Malware distribution host used to deliver macOS payloads; the article identifies it as a centralized host. |
| SHA256 | 462af0a3a9094d44c30cc65544ec1171a62365cff09e67f5e87e061a3d604bd0 | Hash listed for the malicious WindowsDefender.exe artifact. |
| SHA256 | 579a82dde4425d95e20a22171be0a37702c833fdca6e5e04f69099a025863136 | Hash listed for the StartGD22OR21.bat artifact in the Hugging Face IOC section. |
| SHA256 | 89930bd18e0f9c9c98dfb1662cb87aa98348e87164ab62b1f39e86ebf2ce24cb | Hash identified for the ClawHub-DependencyInstaller.exe loader. |
| SHA256 | 9db18aa394f554aa455f3039ce734b1653cc999089889c551fe263bd4bdc39fc | Hash identified for a malicious OpenClaw skill archive. |
| SHA256 | b5da6ffa5f85aa5016fbc02a3122361c85d21192c45df9544099d13e6ff84c36 | Hash listed for the malicious Bao_Cao_Tai_Chinh_2024.pdf.lnk artifact. |
| SHA256 | c7b93b6facfc23f49e35e81dc9c30cc69401b8245eeb7c032fc13656cd7e101f | Hash identified for a cryptominer payload. |
| SHA256 | d42aecf76fb1531cd5b7139e669910b2fd82a90b7e11448128e226775bf5d42e | Hash listed for the xt53.bat artifact in the Hugging Face IOC section. |
| SHA256 | d781d5cabaf5f305bbb8afcd9a54d7ba616bfa7aef5c4d16f6bce3d2bf3b4073 | Hash identified for a second-stage dropper. |
| SHA256 | e84b1e2c432b2394c403b524b8361ffa9923a022eb05215f1dc811bc167c3c5e | Hash listed for the malicious CDC1.bat artifact. |
| SHA256 | f0a54f2b44e557854b0a5001c4e10185884af945814786f78b86539014f78a16 | Hash identified for AMOS Stealer. |
| SHA256 | fd3d52c2bb3764aabfe4da301967bfbc18e1c062d5dad2e9f4c3b6b6cf0ec9f8 | Hash identified for ClawHub-DependencyInstaller.zip, listed as an OpenClaw IOC. |
| URL | hxxp[:]//91[.]92[.]242[.]30/1v07y9e1m6v7thl6 | Specific URL used by the downloaded macOS script to fetch a further payload. |
| URL | hxxp[:]//91[.]92[.]242[.]30/6wioz8285kcbax6v | Specific macOS payload download URL executed through curl. |
| URL | hxxps[:]//github[.]com/toolitletolate/openclaw_windriver/releases/download/exe/openclaw_windriver[.]zip | Specific GitHub release URL listed among Windows malware distribution indicators. |
| URL | hxxps[:]//glot[.]io/snippets/hfd3x9ueu5 | MacOS intermediary URL listed among OpenClaw indicators. |
| URL | hxxps[:]//glot[.]io/snippets/hfdxv8uyaf | MacOS intermediary URL listed among OpenClaw indicators. |
| URL | hxxps[:]//rentry[.]co/openclaw-core | Specific URL listed among indicators associated with the malicious OpenClaw distribution activity. |
| URL | hxxps[:]//t[.]me/dusty_vintage | Messaging link identified as a C2 server. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes obfuscation, encryption, and base64-encoded command strings used to conceal payload behavior.T1036 · MasqueradingPayloads are disguised as Windows Defender or microsoft-update-assist.exe.T1055 · Process InjectionA decoded PowerShell payload allocates executable memory in explorer.exe, writes shellcode, and launches it via a remote thread.T1059 · Command and Scripting InterpreterBash and PowerShell commands and scripts are used to download and execute payloads.T1071 · Application Layer ProtocolThe report describes covert C2 communication through web hosts and messaging links.T1105 · Ingress Tool TransferShell and PowerShell scripts use curl or external repositories to download additional payloads.T1140 · Deobfuscate/Decode Files or InformationThe infection chain decodes base64 commands and decrypts an embedded payload using a single-byte XOR key.T1195 · Supply Chain CompromiseMalicious models, datasets, repositories, and ClawHub skills abuse AI distribution platforms to deliver trojanized artifacts.T1204 · User ExecutionEnticing repository names, README instructions, and installation directions trick users into running malicious packages or commands.T1547.001 · Registry Run Keys / Startup FolderA batch dropper creates the Run key 5PthNvuYXu under the current user's Windows Run registry path for startup persistence.T1553.005 · Mark-of-the-Web BypassThe batch dropper clears the Zone.Identifier alternate data stream to strip Mark-of-the-Web and avoid SmartScreen warnings.
Threat Actors
FAKESECURITYThe researchers track activity involving a payload disguised as Windows Defender as the FAKESECURITY activity cluster; they say they cannot confirm whether it is part of a broader campaign or opportunistic activity.hightower6euThe article identifies this developer account as a primary threat actor and attributes 334 malicious OpenClaw skill uploads to it.ITHKRThe researchers assess with moderate confidence that a PowerShell script and a related domain are associated with this operator.sakaen736jihThe article identifies this developer account as a secondary threat actor and attributes 199 malicious OpenClaw skill uploads to it.zaycvThe article lists this developer account as a minor actor and attributes 21 malicious skills to it.
Malware
Vendors
Products
Acronis EDR / XDRin this report are detected and blocked by Acronis EDR / XDR:ClawHubAcronis TRU uncovered widespread abuse of AI distribution platforms (Hugging Face and ClawHub/OpenClaw) to deliver trojanized models, datasets and agent skills that download and execute hidden payloads, use indirectGitHub[Domain/URL ] staging and distribution hosts – github[.]com/hedefbari/openclaw-agent/releases/download/latest/openclaw-agent[.]zip (Windows malware distribution), hxxps://glot[.]io/snippets/hfdxv8uyaf (macOSHugging FaceAcronis TRU uncovered widespread abuse of AI distribution platforms (Hugging Face and ClawHub/OpenClaw) to deliver trojanized models, datasets and agent skills that download and execute hidden payloads, use indirectmacOSThe campaign includes 575+ malicious OpenClaw skills from 13 developer accounts, cross-platform payloads (Windows and macOS) including AMOS stealer and cryptominers, and staging via repositories and external hosts.Microsoft WindowsThe campaign includes 575+ malicious OpenClaw skills from 13 developer accounts, cross-platform payloads (Windows and macOS) including AMOS stealer and cryptominers, and staging via repositories and external hosts.OpenClawAcronis TRU uncovered widespread abuse of AI distribution platforms (Hugging Face and ClawHub/OpenClaw) to deliver trojanized models, datasets and agent skills that download and execute hidden payloads, use indirect