40 Malicious ClawHub Skills Lure Users to External Malware Site
Summary
Researchers found 40 trojanized ClawHub skills directing users to a lookalike OpenClawCLI site, which served an obfuscated command to download and run malware. The site was offline as of February 9.
Key points
- The skills used documentation as a lure, directing users to install a supposed OpenClawCLI prerequisite hosted at openclawcli[.]vercel[.]app.
- Researchers identified 37 malicious skills under the thiagoruss0 account and three under stveenli.
- The installation command used base64 encoding to conceal a shell command that fetched and executed a payload from 91.92.242.30.
- The article says malicious skills remained in the OpenClaw GitHub repository even after removal from the ClawHub registry.
- The lookalike site was offline as of February 9, 6 a.m. AEST; the article credits Vercel with helping take it down.
- Recommendations include verifying skill dependencies, avoiding unverified installation commands, and searching skill repositories for the lookalike domain.
Article Details
- Attack Vectors
- Trojanized ClawHub skills from accounts thiagoruss0 and stveenli direct users to a lookalike OpenClawCLI website to download malware.
- The fake site provides a base64-obfuscated command that decodes to a curl download piped directly to bash.
- Malicious skills were also retained in the ClawHub GitHub repository after removal from the registry, exposing people who cloned the repository.
- Defensive Notes
- Do not run installation commands from skill documentation without verifying their source; check the official project repository before installing required dependencies.
- Search skill repositories for openclawcli[.]vercel[.]app and block 91.92.242.30.
- Treat skills directing users to install external tools with suspicion, particularly those with random character suffixes; report suspicious skills to ClawHub and OpenSourceMalware.com.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | openclawcli[.]vercel[.]app | Lookalike website used by the trojanized skills to direct users to the malware installation command. |
| IPV4 | 91[.]92[.]242[.]30 | IP-based payload host contacted by the decoded installation command; also identified as C2 infrastructure in the article. |
| URL | hxxp[:]//91[.]92[.]242[.]30/ece0f208u7uqhs6x | Payload URL invoked by the decoded installation command. |
| URL | hxxp[:]//91[.]92[.]242[.]30/tjjae9itarrd3txw | URL listed in the article as C2 infrastructure. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe installation command base64-encodes the shell command to obscure the payload retrieval command.T1059.004 · Unix ShellThe decoded command executes through /bin/bash and pipes the downloaded content to bash.T1105 · Ingress Tool TransferThe command uses curl to retrieve a payload from 91.92.242.30.T1189 · Drive-by CompromiseTrojanized ClawHub skills lure users to a lookalike website to obtain the purported OpenClawCLI tool.T1204.002 · Malicious FileUsers are persuaded to run an installation command that downloads and executes the payload.
People
Vendors
Products
ClawHubThe OpenSourceMalware team has identified a new evolution in ClawHub skill-based attacks. Rather than embedding base64-encoded payloads directly in SKILL.md files — a technique we've documented extensively—threat actorsOpenClawCLIskills from two ClawHub accounts to redirect victims to download what pretends to be a legitimate "OpenClawCLI" tool. This new technique effectively bypasses VirusTotal scanning since the SKILL.md files themselvesVirusTotaldownload what pretends to be a legitimate "OpenClawCLI" tool. This new technique effectively bypasses VirusTotal scanning since the SKILL.md files themselves contain no malicious code—only social engineering that