ClawHavoc Campaign Weaponizes OpenClaw AI Agents for Malware and Crypto Theft
A new campaign dubbed ClawHavoc is exploiting the open-source OpenClaw AI agent platform by distributing malware through poisoned marketplace packages, targeting crypto wallets and sensitive credentials.
Cybercriminals have found a new vector for malware delivery by weaponizing AI agents, specifically targeting the open-source OpenClaw platform. A campaign identified as ClawHavoc abuses OpenClaw's ability to interact with files, messaging apps, and terminal commands by distributing malicious packages through its ClawHub skill registry. These poisoned packages are disguised as legitimate developer, crypto, or automation tools, luring unsuspecting users into installing malware.
The attack chain begins with attackers flooding the ClawHub registry with hundreds of malicious skills, often mimicking legitimate tool names like 'clawhubb' or 'openclawcli'. These fake utilities are designed to trick users into installing them or, more insidiously, pasting seemingly innocuous commands into their terminal. Once executed, these commands download and deploy sophisticated malware, such as NovaStealer v2, which is capable of stealing a wide array of sensitive data.
NovaStealer v2, a macOS-focused information stealer, is particularly adept at exfiltrating data from over 60 cryptocurrency wallets, including popular ones like MetaMask, Phantom, and Exodus. Beyond crypto assets, the malware also targets browser cookies, login credentials, SSH keys, cloud service credentials, and sensitive developer files like .env files. This broad data theft capability makes it a significant threat to individuals and organizations.
The ClawHavoc campaign employs a deceptive lure similar to the 'ClickFix' malware delivery tactic. Instead of directly exploiting a software vulnerability, the malicious packages instruct the AI agent to prompt the user to install a fake security requirement. On Windows, this involves downloading a password-protected ZIP archive, while on macOS and Linux, users are tricked into pasting a Base64-encoded terminal command, which then fetches the malware.
Trellix researchers, who identified the campaign, also highlighted the broader risk of prompt injection. Attackers can embed hidden instructions within content that an AI agent processes, such as emails or documents. If the agent trusts this content, it can be manipulated into executing harmful commands, effectively becoming an unwitting accomplice in data theft or malware deployment, especially when granted broad system permissions.
Organizations running OpenClaw deployments are advised to take immediate security measures. These include updating older versions, avoiding use on primary workstations, and isolating the platform on dedicated virtual servers or network segments. Restricting network access, auditing installed skills, and closely monitoring for suspicious child processes are crucial steps.
Further mitigation strategies involve treating AI-generated tool requests with skepticism, implementing strict permission controls for AI agents, and establishing approval gates for sensitive actions. The campaign underscores the growing need for robust security practices around AI agents, treating their potential for abuse with the same seriousness as traditional privileged applications. The indicators of compromise, including specific IP addresses and file hashes, are provided to aid in detection and response efforts.