Researchers Find 386 Malicious ClawHub Skills Delivering Information-Stealing Malware

Feb 1, 2026 · Original article ↗

Summary

Researchers report 386 malicious ClawHub skills that use social engineering to deliver information stealers targeting macOS and Windows. They describe credential theft techniques and say most skills remained available when the article was updated.

Key points

The researchers identified 386 malicious skills published between January 31 and February 2, following an earlier wave of 28 skills targeting Claude Code and Moltbot users.
The skills masqueraded as cryptocurrency tools and urged users to download or run purported authentication utilities; the campaign relied on social engineering rather than technical exploits.
macOS instructions used base64-encoded shell commands or downloaded binaries from 91.92.242.30; one variant removed quarantine attributes before execution.
Windows users were directed to password-protected ZIP files containing executables, with downloads hosted on GitHub.
The researchers say the malware targeted exchange API keys, cryptocurrency wallets, browser passwords, SSH keys, cloud credentials, and development secrets.
The article reports that 341 second-wave skills downloaded openclaw-agent from GitHub releases, and says the largest publishing account’s skills had accumulated nearly 7,000 downloads.
The researchers said most identified skills were still available in the official skills repository at the time of the update; they also provide indicators and checks for possible infections.

Article Details

Attack Vectors: Malicious ClawHub skills masqueraded as cryptocurrency trading and other utilities, then used social engineering to persuade users to download and execute purported authentication tools.
macOS instructions used base64-encoded shell commands or downloaded a binary from the C2 server, removed its quarantine attribute with xattr -c, made it executable, and ran it.
Windows users were directed to download password-protected ZIP archives from GitHub releases and execute the included AuthTool.exe or PolymarketAuthTool.exe.
The skills delivered information-stealing malware targeting macOS and Windows users; the article reports collection of cryptocurrency keys and wallet data, credentials, SSH keys, browser passwords, and development secrets.
Defensive Notes: Treat skill instructions requiring executable downloads, base64-encoded commands, raw IP addresses, xattr -c, password-protected ZIP files, or urgent claims that a tool is required as red flags.
On macOS, check bash and zsh history, running processes, and the temporary directory for the listed C2 commands and filenames.
On Windows, search user Desktop directories for AuthTool.exe and PolymarketAuthTool.exe.
Review skills before installation and avoid executing commands or binaries supplied by untrusted skills.

Indicators of compromise

Type	Indicator	Context
IPV4	`91[.]92[.]242[.]30`	C2 IP address used by the malicious skills to deliver payloads.
MD5	`a8ad1697e8c8823ac7b77557bcb85a24`	Hash of the second-stage macOS payload.
MD5	`d92be1b82e3ed7be464f4f500d2986e2`	Hash of the first-stage dropper.
SHA256	`28f65cad91c88d8590f5ac4d65d156f3e84e050b06b3d9686e92f1997ef6c7ea`	Hash of the second-stage Windows payload identified as ./openclawcli.exe.
SHA256	`34423bc9ab424455863e2e1865f27fc94ebbcdf28a1dbf9fcbb7a49fff30213c`	Hash of a second-stage Windows payload, identified as ./ClawdBotSignIn.zip.
SHA256	`998c38b430097479b015a68d9435dc5b98684119739572a4dff11e085881187e`	Hash of the second-stage macOS payload.
SHA256	`e3b5a5dbbccab4cf36c7abf5cb5ae83062dd1b5dee7db04bddbf53fc9ebdb233`	Hash of the first-stage dropper.
URL	`hxxp[:]//91[.]92[.]242[.]30/6x8c0trkp4l9uugo`	Malicious URL used by a shell command to download and execute a payload.
URL	`hxxp[:]//91[.]92[.]242[.]30/dx2w5j5bka6qkwxi`	Malicious URL used to download the axiom-agent macOS binary.
URL	`hxxps[:]//github[.]com/Aslaep123/clawd-authtool/releases/download/released/AuthTool[.]zip`	Specific GitHub release URL identified as a malicious Windows payload download.
URL	`hxxps[:]//github[.]com/Aslaep123/PolymarketAuthTool/releases/download/released/PolymarketAuthTool[.]zip`	Specific GitHub release URL identified as a malicious Windows payload download.