Cybercriminals Weaponize OpenClaw AI Agent in ClawHavoc Campaign to Distribute Infostealers
Cybercriminals have turned the OpenClaw AI agent into a convincing delivery mechanism for infostealers through a campaign called ClawHavoc.
Attackers uploaded hundreds of seemingly useful skills to the ClawHub catalog. These skills prompt users to install a mandatory tool or paste an encoded command into the terminal, all while appearing as legitimate configuration steps recommended by the AI assistant.
On macOS, victims are directed to commands that download the Atomic macOS Stealer (AMOS). On Windows, the same technique delivers password-protected archives and fake verification utilities, recreating the classic ClickFix social-engineering pattern but with an AI assistant acting as the trusted courier.
Researchers from Trellix discovered 341 malicious skills in total, 335 of which used fabricated installation requirements for AMOS. Repository history analysis revealed 1,184 suspicious packages associated with 12 distinct authors.
The stolen data includes passwords, browser credentials, cryptocurrency wallets, API keys, SSH keys, cloud accounts, .env files, source code, and tokens for connected services. Once OpenClaw has unrestricted terminal access, a simple text instruction can be converted into a PowerShell or Bash command.
Users are recommended to update OpenClaw, review all installed skills, remove anything suspicious, and rotate any potentially leaked credentials. Security experts advise running the agent in an isolated environment with minimal privileges and no access to production secrets.
Related articles
AI Agents Becoming Core InfoSec Skill Like Microsoft Office Proficiency
Working with AI in information security is shifting from a specialized skill to a baseline expectation similar to using Microsoft Office tools. The key difference lies in the cost of errors: poor Word usage wastes time, while mishandling AI agents burns subscription limits and corporate funds. The article details practical workshops from the Engineering October series covering AI agents from beginner tools to securing the agents themselves. Core concepts include distinguishing models from agents, managing context windows to prevent forgotten instructions, and using skills, MCP connectors, and sub-agents for efficiency. Real-world examples show agents handling CVE analysis, alert triage, and threat report reviews while highlighting risks like hallucinations and data exposure. Guidance covers safe deployment in isolated environments and the irreplaceable role of human expertise in strategy and verification.
Research Exposes Limitations in AI Skill Scanners for Agent Vulnerability Detection
An independent researcher evaluated three local vulnerability scanners for AI agent skill packages without using LLMs or external APIs. The test used 12 synthetic packages containing both benign and malicious instructions, including attempts to bypass consent via sub-agents and hidden instructions in nested files. Cisco Skill Scanner, NVIDIA SkillSpector, and AgentVerus were run in isolated containers. All three tools missed a critical delegation bypass in package 10, while correctly flagging an educational attack citation in package 5 as High severity. NVIDIA SkillSpector performed best on nested file detection, and the findings directly shaped the integration of a lightweight static analyzer plus optional NVIDIA scans into the CEO AI project. The study also highlighted the need to preserve detailed findings rather than relying solely on final safety scores.
Apple Tightens App Store Rules Against Non-Consensual Intimate AI Deepfakes
Apple has updated its App Store guidelines to explicitly prohibit applications that generate intimate deepfake images of real individuals without consent. Developers must now implement measures to prevent creation and distribution of such content and promptly remove any instances that appear. The company also banned the practice of submitting apps with hidden functionality that is activated after passing review, a tactic previously used by undressing services. Violations can result in both app removal and expulsion from the Apple Developer Program. The move follows similar actions against xAI's Grok chatbot, which added safeguards after Apple threatened removal over the same issue. The policy targets non-consensual intimate imagery rather than all deepfake technology.
CyberXero Deploys 51 AI Agents to Scan 4708 Targets and Implant 32 WebShells in 61 Seconds
Russian-speaking initial access broker CyberXero integrated Anthropic's Claude Code and the open-source PentAGI autonomous penetration agent into its attack pipeline, creating a cluster of 51 specialized AI agents. The group ran two parallel operations: one automated campaign targeting vulnerable WordPress and e-commerce sites worldwide using known exploits including CVE-2026-63030, CVE-2026-60137 and CVE-2026-4815, and a second, more targeted campaign against Ukrainian energy and critical infrastructure. In one recorded execution the AI cluster scanned 4708 public-facing hosts, compromised 429 WordPress administrative panels and dropped 32 WebShells within a 61-second window. Attackers bypassed model safety guardrails by resetting sessions and reframing requests as authorized penetration tests of their own infrastructure. The operation relied on an eight-node architecture that included a Linux workstation, configuration server, payload staging server and public Redis instances, two of which belonged to Chinese organizations. SOCRadar warns that session-level controls alone are insufficient and recommends enforcing system-level boundaries, minimal privileges and strict egress filtering for any AI agents.