In June 2026, Palo Alto Networks’ Unit 42 reported that ClawHub, the official marketplace for OpenClaw, had exposed developers and other power users to a supply chain attack. OpenClaw launched in November 2025 as an open-source agent that can browse the web, manage files, and take actions on a user’s system. Unit 42 said ClawHub distributed five malicious OpenClaw skills, including two that installed Atomic macOS Stealer on Macs.
Unit 42 said two of those packages dropped Atomic macOS Stealer. One of them slipped past both VirusTotal and ClawScan by padding its README beyond the scanners’ size limits. The researchers also said two other packages were built for commission fraud.
They also found persistence and evasion techniques, which points to a broader problem in how sensitive skills are reviewed.
Bitdefender Labs had already sounded the alarm in February 2026, warning that about 17% of the OpenClaw skills it analyzed showed malicious behavior. Bitdefender said many of those skills posed as utility tools, especially crypto-related ones, and used hidden commands to download malware or quietly tamper with transactions, affiliate links, and crypto activity.
If you use OpenClaw regularly, take this seriously. The affected skills were published through ClawHub, OpenClaw’s official marketplace.
According to Unit 42, OpenClaw has since removed the affected skills and banned the publishers. Security experts are still pushing for stricter publisher vetting, line-by-line audits for high-risk packages, and a formal review process so third-party skills don’t end up becoming shadow IT inside your company.
Author: Monique Irish Casingal
{
"social": {
"email": "",
"facebook": "",
"twitter": "",
"linkedin": ""
},
"ja-JP": "",
"de-DE": "Monique Irish Casingal ist Content-Writerin mit Schwerpunkt auf Software-Rezensionen und digitalen Tools. Sie hilft Nutzern dabei, die richtigen Anwendungen für ihren Alltag und ihre Arbeit zu finden.",
"en-US": "Monique Irish Casingal is a content writer specializing in software reviews and digital tools. She helps users navigate the ever-expanding world of apps and programs to find the right solutions for their everyday needs.",
"es-ES": "Monique Irish Casingal es redactora de contenidos especializada en reseñas de software y herramientas digitales. Ayuda a los usuarios a encontrar las aplicaciones más adecuadas para su día a día.",
"fr-FR": "Monique Irish Casingal est rédactrice de contenu spécialisée dans les critiques de logiciels et les outils numériques. Elle guide les utilisateurs vers les meilleures applications pour leurs besoins quotidiens.",
"it-IT": "Monique Irish Casingal è una content writer specializzata in recensioni di software e strumenti digitali. Aiuta gli utenti a trovare le applicazioni più adatte alle loro esigenze quotidiane.",
"nl-NL": "Monique Irish Casingal is een content writer gespecialiseerd in softwarereviews en digitale tools. Ze helpt gebruikers de juiste applicaties te vinden voor hun dagelijkse behoeften.",
"pl-PL": "Monique Irish Casingal jest content writerką specjalizującą się w recenzjach oprogramowania i narzędzi cyfrowych. Pomaga użytkownikom znaleźć odpowiednie aplikacje na co dzień.",
"pt-BR": "Monique Irish Casingal é redatora de conteúdo especializada em análises de software e ferramentas digitais. Ela ajuda os usuários a encontrar as melhores aplicações para o dia a dia."
}
View all posts by Monique Irish Casingal
