@ruby111
Stolen Credentials and Crypto Drains
OpenClaw agents run with high privileges on your machine. Reading files, executing commands, accessing emails/calendars, and connecting to wallets/APIs.
Malicious "skills" (plugins from ClawHub marketplace) pretend to be helpful tools (e.g., "solana-wallet-tracker", "bybit-agent", or crypto trading bots) but secretly install infostealers like Atomic Stealer (macOS) or keyloggers (Windows).
They harvest API keys, wallet private keys, browser passwords, SSH credentials, and more ,then exfiltrate them silently to attacker servers.
Result: users lose crypto holdings (e.g., drained Base/USDC wallets), email accounts hijacked, or full system compromise.
Researchers found 341–386 malicious skills in ClawHub (12–15% of the registry in some scans), many from coordinated campaigns like "ClawHavoc". Crypto focused skills were especially targeted.
0 reply
1 recast
10 reactions