Infostealer Targets OpenClaw to Loot Victim’s Digital Life

Researchers documented the first observed live infostealer attack against OpenClaw, a local AI assistant, where malware harvested configuration and secret files (openclaw.json, device.json, soul.md, agents.md/memory.md). Stolen tokens, private keys and personal memory logs could allow attackers to connect to local OpenClaw instances, impersonate users, bypass device checks, access encrypted logs and orchestrate broad identity and operational compromises; defenders warn this will likely lead to dedicated malware modules targeting AI-agent artifacts.