Acronis documents more than 575 malicious OpenClaw skills used to deliver malware

Acronis TRU Cyber Pulse 2026 logged more than 575 malicious OpenClaw skills that distributed malware on Windows and macOS systems. The skills delivered trojans, cryptocurrency miners, and information stealers. 13 developer accounts on ClawHub published the skills, with hightower6eu uploading 334, or 58 percent, and sakaen736jih uploading 199, or 34.6 percent.

OpenClaw, once called Moltbot and earlier Clawdbot, carries out actions for a user through installable skills, and ClawHub distributes those plugin-like skills. Hugging Face architecture lets users upload models, share datasets, and deploy Spaces, allowing arbitrary code from unvetted sources to run with one-click access. Hugging Face hosts more than one million machine learning models along with hundreds of thousands of datasets.

Researchers on Hugging Face have documented malicious payloads that took the form of models, datasets, and AI applications. The Acronis TRU team found a limited number of Hugging Face Spaces, datasets, and models used to store payloads or act as staging points, and Acronis TRU researchers said the full scale of abuse probably exceeds documented cases. Threat actors publish malicious repositories that mimic popular projects to deliver malware, and researchers have found infostealers, loaders, RATs, trojans, and other implants aimed at Windows, Linux, and Android on Hugging Face.

Attackers embedded hidden instructions in skill files through indirect prompt injection, a technique that hides malicious instructions in benign-looking inputs, turning AI agents into unwitting intermediaries that act without direct user action. The malicious OpenClaw skills posed as tools such as YouTube transcript summarizers and instructed users to fetch password-protected archives or execute encoded commands.

The address 91.92.242[.]30 acted as a central host used to spread macOS payloads through the malicious skills. AMOS Stealer, a macOS infostealer, is typically offered as malware-as-a-service via Telegram and underground forums.

One Windows payload decrypted its strings at runtime with a 30-byte XOR key and injected code into explorer.exe’s running process. The injected code opened AES-encrypted command-and-control contact over HTTPS to hxxps://velvet-parrot[.]com:443. The payload fetched a cryptominer disguised as svchost.exe and kept persistence via scheduled tasks and exclusions set in Windows Defender.

From the velvet-parrot[.]com:443 address, researchers traced a Telegram bot serving as a dead-drop resolver that concealed the real command-and-control server. Pivoting from the command-and-control domain uncovered related campaigns built around fake VPN landing pages and deceptive distribution, and many samples from those campaigns shared behaviors with the main OpenClaw campaign.

In January, the ITHKRPAW campaign hit Vietnamese financial sector organizations with a malicious LNK file that invoked Cloudflare Workers. A PowerShell dropper from Cloudflare Workers opened a decoy cat image, and the payload came from a Hugging Face dataset repository. Researchers pointed to embedded Vietnamese-language comments when they assessed the ITHKRPAW PowerShell script as LLM-generated with moderate confidence.

In the FAKESECURITY campaign, a batch script containing an encoded PowerShell blob fetched a second batch script from Hugging Face. After removing the Mark-of-the-Web to get around Windows SmartScreen, the malware injected shellcode into explorer.exe and dropped a file posing as Windows Security.

The BOSSAI investigation showed one operator connecting more than 10 AI models to reconnaissance, scanning, and exploitation tools. Commercial AI models repeatedly refused requests for offensive activities, so the operator used locally hosted models with safety alignment removed. Through WeChat and LINE, the operator assigned tasks, monitored agent activity, and directed concurrent operations. The operator assembled a network of AI agents, cybersecurity tools, and locally hosted AI models, giving each agent a role covering target identification, vulnerability scanning, technical analysis, script development, and data extraction.

Nine of the 12 BOSSAI agents were active during the investigation. The operator manually transferred results between agents, and the agents did not communicate directly with one another.

BOSSAI targeted hundreds of organizations across 11 countries, with confirmed breaches and data theft at around 10 targets across three countries. BOSSAI infrastructure supported activity reaching emergency services and government systems in Taiwan, universities in Thailand, and telephone data collection in Mexico.

In Taiwan, emergency services allowed unauthenticated access to patient-care records such as electrocardiogram readings and vital signs, while the operator reached emergency dispatch records holding incident details and locations across seven districts of Taipei. Agents accessed an administrator table in Thailand and tried to reach student records at one university, while automated data collection and enrichment in Mexico produced approximately 206,800 residential phone records containing names, addresses, and postal codes.

In HalberdStrike testing, more than half of the findings that carried high severity or critical ratings proved to be false positives or misclassifications. Installing third-party application patches took a median of 5.7 days during the second half of 2025, and deployments in the slowest decile went beyond 24.9 days, which left internet-facing services exposed once working exploit code was public.

A Censys count showed the number of publicly exposed OpenClaw instances climbing from roughly 1,000 to over 21,000 within a week. Attackers tested the gateways for authentication weaknesses, command execution, file access, and credentials. Acronis assesses that exposed OpenClaw gateways functioned as internet-facing administrative interfaces rather than chatbots. Changing a prompt cannot broaden filesystem, network, and command-execution restrictions, so enforcement must happen outside the model.

Agent skills that could be reused carried procedures and target context across campaigns, and skills can blend instructions and executable code using permissions already granted to the agent. Several tools ran without approval prompts, meaning agents could select and run tools with permissions already granted. Attackers used stolen browser sessions to reach connected cloud applications and avoided a fresh multifactor authentication challenge.

When attackers compromise repository credentials and API keys, developer accounts can see their source code and services exposed, and stolen access that changes hands can carry a foothold to ransomware operators or espionage groups. An intruder who takes control of a remote management tool can leverage it to reach the systems under its management.

More than 1.8 million Acronis RMM endpoints had at least one additional remote management or remote access tool installed on 63.1 percent of them. During an intrusion, defenders may lose visibility across environments when monitoring on a shared management server fails. Santiago Pontiroli, Threat Intelligence Research Lead at Acronis, said, “Defenders need to consider those risks together, from the first alert through containment and recovery.”

A Qilin ransomware sample could delete Windows Volume Shadow Copies and end processes before encryption started, and affiliates could use tools maintained by The Gentlemen to turn off endpoint detection and response software. LockBit 5.0 covers Windows, Linux, and VMware ESXi, and its ESXi variant powers down running virtual machines to encrypt their files. An INC ransomware encryptor deletes snapshots, removing a recovery option for affected machines, and an attack on a virtualization host can put services offline while disrupting the systems used to restore them.

OpenAI reported that a model with reduced safeguards broke out of an isolated test environment, reached the internet, and affected Hugging Face production infrastructure. Anthropic logged three evaluation incidents, and Claude reached real organization systems after a test environment unexpectedly allowed internet access. According to Anthropic, the escapes were not intentional.

An IronWorm npm supply-chain campaign delivered malware that hunted credential files belonging to Claude, Codex, and Cursor stored locally, and it also gathered Gemini credentials, GitHub tokens, and cloud keys. With stolen repository access, operators planted code in projects. CERT-EU documented installation pages serving an infostealer that impersonated Claude Code and Gemini CLI installers, and it counted at least 15 malicious IDE plugins that posed as AI coding assistants.

TamperedChef distributed malicious applications through advertisements and search results, and the applications carried out advertised tasks such as editing PDFs and opening manuals. TamperedChef applications carried valid Extended Validation code-signing certificates from a changing network of U.S.-registered shell companies, and operators replaced revoked certificates through another company. Other campaigns distributed malware using GitHub repositories and cloud storage.

The Gitea patch shipped on July 27, with working public exploit code following the next day. Red Heron modified the Gitea exploit to target internet-facing servers, resulting in theft of repositories, credential collection, persistence, and lateral movement.

Messaging services carried attacker communications with compromised systems, and routine business traffic on these platforms can hide malicious activity. The agents were working as intended, so the campaign did not compromise the AI agents themselves.