Cybercriminals are exploiting OpenClaw, an open-source platform that allows AI agents to interact with files, messaging apps, and execute terminal commands. A campaign called ClawHavoc has hijacked OpenClaw’s ClawHub registry, inserting malicious packages disguised as developer or crypto tools. These poisoned packages deliver data-stealing malware that targets crypto wallets, browser data, credentials, and more. ([cybersecuritynews.com](https://cybersecuritynews.com/openclaw-ai-agents/))
Researchers at Trellix uncovered the campaign after spotting the exploitation of critical flaws in OpenClaw. Attackers flooded ClawHub with more than 350 fake “skills” named to imitate legitimate tools—packages with names like “clawhubb”, “clawhub-cli”, and “openclawcli”—intended to deceive users searching for crypto automation, social media integrations, or helpful developer tools. ([cybersecuritynews.com](https://cybersecuritynews.com/openclaw-ai-agents/))
How the Malware Gains Access
Instead of using a traditional exploit, the campaign relies on prompt-based manipulation. Once a user installs a deceptive skill, they’re guided to download and run an “AuthTool” supposedly required for security purposes. On Windows systems, victims are directed to a password-protected ZIP file; on macOS and Linux, they are tricked into pasting a Base64-encoded terminal command. That action installs NovaStealer v2, an information stealer that can harvest data from over 60 crypto wallets—such as MetaMask, Phantom, Exodus, and Electrum—as well as browser cookies, SSH keys, cloud credentials, and other sensitive files. ([cybersecuritynews.com](https://cybersecuritynews.com/openclaw-ai-agents/))
The campaign also involves prompt injection attacks. Attackers embed malicious instructions within emails, documents, or web content. If the AI agent processes this content without scrutiny, it may mistake it for legitimate input. Trellix demonstrated that OpenClaw agents can read clipboard data, download and execute files, and create scheduled tasks when given unsafe instructions. ([cybersecuritynews.com](https://cybersecuritynews.com/openclaw-ai-agents/))
Mitigations and Best Practices
To protect against threats like ClawHavoc, organizations using OpenClaw are advised to run the software on isolated machines or virtual servers instead of primary workstations. Updating older versions is essential. ([cybersecuritynews.com](https://cybersecuritynews.com/openclaw-ai-agents/))
Tightening permissions is crucial. That means restricting network access, limiting the accounts tied to AI agents, and carefully auditing all installed skills. IT security teams should flag suspicious processes—such as PowerShell launched by node.exe, commands like curl or nc.exe, or scheduled tasks (schtasks.exe) appearing unexpectedly. ([cybersecuritynews.com](https://cybersecuritynews.com/openclaw-ai-agents/))
Investigators also emphasize treating any external or AI-generated tool request as untrusted until verified. Practices like allow-listing tools, enforcing least-privilege, inserting approval gates before executing sensitive actions, and monitoring access to secrets are encouraged. ([cybersecuritynews.com](https://cybersecuritynews.com/openclaw-ai-agents/)) Indicators of compromise include IP addresses tied to ClawHavoc infrastructure, SHA-256 hashes of known malicious binaries, and unusual file paths used during staging. ([cybersecuritynews.com](https://cybersecuritynews.com/openclaw-ai-agents/))
This incident underscores a growing risk: AI agents, when granted privileges over local files, commands, and cloud accounts, become high-value targets for attackers. ClawHavoc demonstrates that even open-source agent platforms with strong intentions can be subverted through social engineering, supply-chain fraud, and privileged access abuse. As AI agents proliferate across development, automation, and personal productivity workflows, mounting vigilance is required from both developers and users. Stay alert, verify dependencies, and critically evaluate agent permissions to stay ahead of threat actors.
