Hackers Abuse ClawHub Skills to Evade VirusTotal via Social Engineering
ID: 04359d2f-7893-5621-a6ee-212445c0bf4c
STIX ID: report--04359d2f-7893-5621-a6ee-212445c0bf4c
Feed Name: GBHackers
Threat Score
A campaign abused ClawHub skill pages to socially engineer users into installing a trojanized "OpenClawCLI" hosted on lookalike sites (openclawcli.vercel.app / openclawd.ai), using 40+ malicious skills from two accounts; by keeping payloads off the SKILL.md files the attackers evaded VirusTotal scanning. The infrastructure included an IP (91.92.242.30) and obfuscated install commands; Vercel took down the primary site on 2026-02-09, but removed skills remain accessible via the ClawHub GitHub repository, preserving exposure.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.