AI Agents Weaponized to Push Malware, Steal Crypto Wallets

Key Takeaways

• Cybercriminals are exploiting the OpenClaw AI agent platform to distribute malware and steal sensitive data, including cryptocurrency wallets.
• The “ClawHavoc” campaign injected over 350 malicious “skills” into OpenClaw’s ClawHub registry, impersonating legitimate developer and crypto tools.
• Attackers leverage social engineering and deceptive prompts to trick users into executing malicious commands, leading to the deployment of information stealers like NovaStealer v2.
• The attack highlights the critical risk of granting broad permissions to AI agents, especially when combined with supply chain vulnerabilities and prompt injection techniques.
• Organizations using OpenClaw should update deployments, restrict network access, audit installed skills, and monitor for suspicious processes.

A new wave of cyberattacks is leveraging artificial intelligence agents as a conduit for malware delivery, specifically targeting OpenClaw, an open-source platform designed to facilitate AI agent interaction with various digital environments. This campaign, dubbed “ClawHavoc,” has been observed using compromised marketplace packages to implant data-stealing malware on unsuspecting users’ systems, posing a significant threat to cryptocurrency wallets and other sensitive information.

The attackers infiltrated OpenClaw’s ClawHub skill registry, populating it with malicious packages disguised as beneficial developer tools, cryptocurrency utilities, and automation scripts. These seemingly legitimate offerings tricked users into installing harmful applications or executing dangerous commands directly within their terminal, paving the way for the deployment of malware capable of exfiltrating crypto wallet credentials, passwords, browser data, and developer authentication tokens.

Security researchers at Trellix uncovered this sophisticated activity while investigating critical vulnerabilities and ongoing exploitation within OpenClaw deployments. Their findings indicate that ClawHavoc extends beyond a typical malicious package distribution, demonstrating a concerning evolution in how threat actors can manipulate trusted AI workflows to persuade users and execute harmful commands on systems with elevated privileges. Trellix’s report shared with Cyber Security News (CSN) provides an in-depth analysis of the observed infection chain and outlines crucial defensive measures.

The inherent danger lies in the extensive permissions often granted to AI agents, allowing them access to local files, cloud services, communication applications, and command-line interfaces. If a malicious actor gains control over an agent’s “skill” or injects hidden instructions into content the agent processes, the AI itself can inadvertently become an accomplice in data theft or malware propagation. This incident underscores the urgent need for AI agent permissions to be scrutinized with the same rigor applied to any privileged application, as highlighted by recent reports concerning OpenClaw marketplace supply chain risks.

Hackers Weaponize OpenClaw AI Agents

According to Trellix, attackers saturated ClawHub with more than 350 malicious skills. They employed deceptive naming conventions, such as clawhubb, clawhub-cli, and openclawcli, to mimic legitimate tools and target individuals searching for cryptocurrency automation, software updates, and social media integrations. Some of these fraudulent packages were artificially boosted to create an illusion of popularity and trustworthiness.

The malicious instructions employed a “ClickFix-style” social engineering tactic. Rather than directly exploiting a software flaw, the compromised package directed the AI agent to prompt its user to install a supposed “security requirement” named “AuthTool.” On Windows systems, victims were led to a password-protected ZIP archive. For macOS and Linux users, the attack encouraged them to paste a Base64-encoded terminal command.

Executing this command resulted in the download of NovaStealer v2, a macOS-centric information stealer associated with the notorious Atomic macOS Stealer family. This potent malware is designed to scour systems for data from over 60 cryptocurrency wallets, including popular ones like MetaMask, Phantom, Exodus, and Electrum. Beyond crypto assets, NovaStealer v2 also harvests browser cookies, login credentials, SSH keys, cloud account credentials, and .env files.

This campaign mirrors a broader trend observed in attacks against Apple users, where sophisticated social engineering tactics coerce victims into manually executing terminal commands. A recent ClickFix malware delivery campaign similarly exploited fake updates and deceptive prompts to target browser data, credentials, and cryptocurrency wallets.

Prompt Injection Raises the Stakes

Trellix also issued a warning that poisoned skills represent only one facet of the emerging threat landscape. Attackers are increasingly employing indirect prompt injection, a technique where hidden instructions are embedded within emails, documents, web pages, or chat messages that an AI agent is tasked with processing. The agent may then misinterpret this attacker-controlled text as a legitimate instruction rather than untrusted content.

During their testing, researchers demonstrated that OpenClaw, when subjected to malicious commands, could read clipboard contents, download and execute files, and create scheduled tasks. While such capabilities are beneficial for automation, they become exceptionally dangerous when an AI agent possesses unrestricted operating system access and implicitly trusts hostile instructions. Prior prompt injection attacks against coding agents have already demonstrated how hostile repository content can lead to unauthorized command execution.

What You Should Do

• Update OpenClaw Deployments: Ensure all OpenClaw installations are running the latest available versions to benefit from any security patches.
• Isolate OpenClaw Instances: Avoid running OpenClaw on primary workstations. Instead, deploy it on isolated devices or virtual servers with minimal access to sensitive data and networks.
• Restrict Network Access: Implement strict network segmentation and firewall rules to limit OpenClaw’s ability to communicate with external or untrusted resources.
• Use Low-Risk Accounts: Connect AI agents only to accounts with the fewest possible privileges required for their function.
• Audit Installed Skills: Regularly review and audit all installed skills within ClawHub or any other AI agent marketplace for legitimacy and potential malicious intent.
• Monitor for Suspicious Child Processes: Actively monitor systems for unusual child processes originating from OpenClaw or its associated components. Specifically, watch for node.exe launching suspicious commands like PowerShell, curl, nc.exe, or schtasks.exe.
• Treat AI-Generated Tool Requests as Untrusted: Always verify and manually approve any tool requests or commands suggested by an AI agent, especially before sensitive actions.
• Implement Least Privilege: Enforce the principle of least privilege for AI agents, restricting their permissions to only what is absolutely necessary.
• Require Approval Gates: Introduce approval mechanisms before AI agents can execute sensitive actions or access critical resources.
• Separate External Content from Privileged Commands: Design workflows that clearly separate external, untrusted content from commands that could grant an AI agent privileged access or execution capabilities.
• Follow AI Prompt Injection Research: Adhere to guidance from related <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/dd6f296e-eda6-43be-b7c4-59a923b5a2b1/Hackers-Weaponize-OpenClaw-AI-Agents-to-Push-Malware-and-Steal-Crypto-Wallets.pdf?AWSAccessKeyId=ASIA2F3EMEYE65Q23DZS&Signature=ThqttqXXUWf6wX3F%2BGxYZxEPpGQ%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEMT%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIQCPvI6E4%2Bpkc7Q8Tt1b5Rm4g9A7A8%2FG%2BvLKiln%2BU2QwBQIgBcuPMtv2scxN9csQvGRIBdecKVDTPNk25ome3xh6rhAq%2FAQIjP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgw2OTk3NTMzMDk3MDUiDGZtRbGns%2BB7HEEruCrQBFmHaiE6CacroouYyykb9AYvfoaW7OOCf6KclqFfjHiPSuo5WsM8jRwPH%2FjT4xChhdrXDyy0kBE6Dpr%2FlvyOG53zm3QbKUomznn2uXNk4SBm7JF0CSef90wcXcjF3ICEyyF%2BQhOJfiPE7qFA%2BV3gMbxaTQCgjYlvIvjfN4GOUU8XYDhzDpGtHO59ePq67pJ0pKBLDOVM2yDq1ctbbATJjftTDLoixOgKN0OC5T3o6Pup78%2FRh5rynVrPkvQqFWrK6yCqAz0mpU0%2F3l9sHdxEvuxzmHmvDx0sk9YgcPQl3DaXpA5RD7wd2DlXUcHZ9LWcyV%2BaSHdlRabTISpQwaAykAiA00W1zm39dD9LaZk06u7aam%2F7nmbSaa6zW5PgrvnHkalv%2FTCRM3I0t%2BAE78cy%2FGnYy%2B0YLsgbjyqEy6ntkuPtvz2Od4GO4A75yNMPLrchFTx5XzKnRGNKxo6MjW%2Fgcr73WKnDqA9u

  Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.

  Tags:

  AttackExploitHackerMalwareSecurityThreat