ClawHub

Disclosed Feb 2, 2026Unverified

Over 230 malicious OpenClaw skills pushed info-stealing malware to AI agent users

Between Jan. 27 and Feb. 1, 2026, more than 230 malicious skills posing as crypto, finance and social media tools were published to ClawHub, the official registry of the OpenClaw AI assistant, and GitHub, delivering malware that stole API keys, wallet keys, SSH credentials and browser passwords.

What is known

People affected	Not stated in the sources we have
Disclosed	Feb 2, 2026
Attack	Supply chain
Data exposed	API keysCredentials and tokensFinancial
Sector	AI
Status	Unverified: not yet confirmed by an official notice, a filing or the organization

Sources

Newsbleepingcomputer.com

Malicious MoltBot skills used to push password-stealing malware

Notices filed

TotalFeb 2

ResearchCount not stated

History of this record

Added2026-09-25

First recordedby seedSource

First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.

Everything about ClawHub