Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users

Koi Security found 341 malicious skills in the ClawHub marketplace that use fake prerequisites and obfuscated install scripts to deliver credential- and API-key-stealing malware (Atomic Stealer and trojans) to OpenClaw users; the campaign (ClawHavoc) uses social engineering and a common C2 (91.92.242.30) to fetch payloads and exfiltrate secrets, representing a significant supply-chain risk for users running self-hosted AI assistants.