OpenClaw deployments have become a target for threat actors using supply-chain poisoning, ClickFix social engineering, and indirect prompt injection.
According to Trellix Advanced Research Center, attackers abused the ClawHub skill registry to distribute NovaStealer, an information-stealing malware variant designed to target cryptocurrency wallets, developer credentials, browser data, and AI-agent context.
The campaign, tracked as ClawHavoc, reportedly affected more than 300 skills and platforms during early 2026.
Attackers uploaded malicious packages that impersonated legitimate OpenClaw tools, including typosquatted names such as “clawhub-cli,” “clawhubb,” and “openclawcli.”
Some packages were artificially promoted through manipulated download metrics.
OpenClaw connects large language models to local systems, allowing agents to read files, run terminal commands, access messaging apps, and automate workflows.
This level of access can become dangerous when an agent processes untrusted skills, documents, emails, or web content.
NovaStealer Targets Crypto Wallets
Malicious ClawHub skills reportedly included deceptive instructions in SKILL.md files. These instructions persuaded users to install a supposed “AuthTool” or manually execute Base64-encoded commands to resolve a fake configuration problem.
On macOS and Linux, the encoded command downloaded a payload from the IP address 91.92.242.30. The payload was identified as NovaStealer v2, a universal Mach-O binary capable of running on both Intel and Apple Silicon devices.
NovaStealer searches for high-value data, including:
- More than 60 cryptocurrency wallets, including MetaMask, Phantom, Exodus, and Electrum
- SSH private keys such as
~/.ssh/id_rsa - AWS credentials stored in
~/.aws/credentials .envfiles containing tokens and application secrets- Browser cookies, saved logins, and macOS Keychain data
- OpenClaw-related files, including agent activity and LLM context information
The malware uses XOR-based string obfuscation to conceal internal paths and command-and-control infrastructure until runtime. This can make static analysis and signature-based detection more difficult.
Researchers also warned that OpenClaw’s ability to process external content creates an indirect prompt injection risk. An attacker could hide malicious instructions in an email, website, document, or chat message that the agent is asked to summarize or analyze.
If the agent accepts those instructions as legitimate, it could generate a tool call that downloads files, runs PowerShell or shell commands, accesses clipboard data, or creates scheduled tasks for persistence. In this scenario, the attacker does not need direct access to the agent’s chat interface.
The key risk is unrestricted command execution. If an LLM-generated command is passed to the operating system without strict validation, sandboxing, and user approval, the agent can effectively become a malware execution mechanism, Trellix said.
Indicators of Compromise
| Type | Indicator | Description |
|---|---|---|
| IPv4 address | 91.92.242.30 | Primary NovaStealer payload-delivery and C2 server linked to the ClawHavoc campaign |
| IPv4 address | 95.92.242.30 | Secondary C2 infrastructure reportedly associated with as |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
