Malicious ClawHub Skills Target OpenClaw Users

This blog details a supply-chain style campaign where threat actors published ~386 malicious ClawHub/OpenClaw skills that social-engineer users into downloading and executing payloads (macOS and Windows) that harvest cryptocurrency keys, browser and keychain credentials, SSH and cloud credentials; the report provides attack chains, malware hashes and filenames, a shared C2 IP (91.92.242.30), affected repositories/users, and detection/remediation guidance.