Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users

A report in The Hacker News that researchers found 341 malicious ClawHub skills stealing data from OpenClaw users. The companion cites it as a supply-chain parasite: 341 of 2,857 skills on one public registry were malicious, 335 from a single human-run campaign, and installed credential-stealing malware on agent owners' machines. It places malicious code among the parasites of agents in Fig. 1.

Cited in

both papers (Flagship: Fig. 1; Companion §4, Fig. 1)

Used for

Food web (supply-chain parasites); Fig. 1

Strand

Cybersecurity & AI-enabled attack · Prompt injection, agent worms & supply-chain parasites

Cite

@misc{clawhavoc2026,
  title = {Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users},
  author = {Ravie Lakshmanan},
  year = {2026},
  howpublished = {The Hacker News},
  url = {https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html},
}