OpenClaw Adoption Brings Exposed Gateways and Malicious Extensions
Summary
Reports describe exposed OpenClaw gateways probed for command execution and credentials, a malicious VS Code extension deploying ScreenConnect, and ClawHub skills targeting browser and crypto-wallet data. The article recommends access controls, least privilege and skill
Key points
- OpenClaw combines a Gateway using a WebSocket API on TCP/18789 with persistent memory and executable skills that can access local files, networks and credentials.
- Pillar Security reported that its honeypot received direct Gateway probes for command execution, file reads and token harvesting; the article says authentication-default and reverse-proxy trust issues were fixed on January 26, 2026.
- Censys reported more than 21,000 publicly exposed instances as of January 31, 2026, up from about 1,000 in under a week.
- Aikido documented a malicious VS Code extension called “ClawdBot Agent” that ran on startup and installed ConnectWise ScreenConnect configured to connect to an attacker relay; a DLL sideloading path was described as a fallback.
- Tom’s Hardware reported that 14 malicious skills were uploaded to ClawHub from January 27–29, 2026, posing as crypto-wallet tools and using obfuscated commands to target browser and wallet data.
- The article recommends keeping the Gateway local or behind secure tunnels, using least-privilege accounts and tokens, and reviewing, scanning and allowlisting skills.
Article Details
- Event Type
- Reported security incidents involving exposed OpenClaw Gateways, impersonation, and malicious extensions and skills.
- Impact
- Researchers reported unauthenticated access and reverse-proxy authentication bypasses affecting exposed Gateways, with attackers attempting command execution, file reads, and credential and token harvesting. Censys reported more than 21,000 publicly exposed instances as of January 31, 2026. A malicious VS Code extension installed a ConnectWise ScreenConnect implant configured to contact an attacker relay, while 14 malicious ClawHub skills were reported uploaded between January 27 and 29 and were intended to harvest browser and cryptocurrency-wallet data on Windows and macOS. The article says the cited Gateway authentication issues were fixed on January 26, 2026.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | meeting[.]bulletmailer[.]net | Attacker relay domain embedded in the malicious extension’s ConnectWise ScreenConnect configuration. |
MITRE ATT&CK
T1005 · Data from Local SystemProbes attempted to read local session logs and other files.T1041 · Exfiltration Over C2 ChannelThe ScreenConnect implant was configured to contact an attacker relay; the article describes this as supporting command and control and data exfiltration.T1059 · Command and Scripting InterpreterAttackers used command-execution and file-access probes, including JSON-RPC tool execution patterns.T1105 · Ingress Tool TransferThe malicious DLL could fetch payloads from Dropbox, and the extension retrieved configuration from attacker infrastructure.T1190 · Exploit Public-Facing ApplicationAttackers targeted internet-exposed Gateway APIs, including unauthenticated access and authentication-bypass paths.T1195 · Supply Chain CompromiseMalicious marketplace skills and an impersonating extension were used to distribute payloads through adjacent software channels.T1204 · User ExecutionSocial engineering prompted users to run obfuscated terminal commands that fetched and executed remote scripts.T1547 · Boot or Logon Autostart ExecutionThe malicious VS Code extension used an onStartupFinished activation event to run automatically when VS Code started.T1552 · Unsecured CredentialsAttackers sought API keys, chat tokens, Gateway credentials, and conversation history.T1574 · Hijack Execution FlowA Rust-based DLL reportedly used DLL sideloading as a fallback payload-delivery method.
People
Products
ClawHubClawHub hosted malicious skills that ran real code; social engineering encouraged users to run obfuscated oneâliners that fetched and executed remote scripts to harvest browser/cryptowallet data on Windows and macOS.ConnectWise ScreenConnectextension named “ClawdBot Agent” that autoâactivated on startup and installed a preconfigured ConnectWise ScreenConnect implant, with fallback payload delivery (DLL sideloading, Dropbox) for resilience.OpenClawOpenClaw rapidly scaled from a local open-source personal AI assistant into a widely deployed agentic platform whose Gateway, stateful memory, and executable “skills” created new highâprivilege attack surfaces whenVS CodeMultiple teams observed internetâexposed Gateways, reverseâproxy auth bypasses, malicious VS Code extensions and trojanized skills that harvested tokens, deployed remoteâaccess implants and exfiltrated data.