Hackers Exploring OpenClaw for Malware Distribution
TL;DR
Researchers from Bitdefender Labs have identified that OpenClaw, an automation platform utilizing artificial intelligence, is being used as a means for malware distribution. Analysis revealed that among the skills examined, approximately 17% exhibited malicious behavior in February 2026.
Hackers explore OpenClaw as a vector for malware in malicious skills
Researchers from Bitdefender Labs have identified that OpenClaw, an automation platform utilizing artificial intelligence, is being used as a means for the distribution of malware. The analysis revealed that among the skills examined, approximately 17% exhibited malicious behavior in February 2026.
Malicious actors are leveraging the open ecosystem of OpenClaw to disseminate harmful code, disguising it as legitimate extensions. The fraudulent skills adopt names similar to those of authentic resources, making it easier for them to be included in the official list and deceiving users into installing them.
Distribution of malicious skills
The skills related to cryptocurrencies are the most common among frauds, representing 54% of the total identified. The distribution among these skills includes:
- 14% focused on monitoring cryptocurrency wallets;
- 9.9% associated with Polymarket;
- 9.3% related to Solana;
- 8.2% disguised as tools for Phantom Wallet;
- 5.2% linked to Ethereum and Bitcoin.
Skills aimed at social media automation come in second, with 24% of the cases, with 16.5% directed at YouTube and 7.4% at X.
How malicious skills operate
The installation of fake skills opens doors for the entry of malicious codes hosted on external servers. One particular IP, 91.92.242.30, was associated with 199 analyzed scripts that can steal sensitive data and allow remote control of the compromised system.
An example is a skill that presented itself as a legitimate installer for macOS, but hid encrypted commands that downloaded malicious scripts. These scripts consecutively copied binary files to temporary directories and executed harmful codes.
Recommendations for users
Bitdefender recommends that the selection of skills for OpenClaw be done with the same caution applied to the installation of conventional software. To assist in this process, they have made available the Bitdefender AI Skills Checker, a tool that verifies the security of available online skills.
Although OpenClaw is recognized for its automation capability, it is important to treat it as an experiment, given the complexity of installation and the security risks that may arise from improper use.
Conclusion
As artificial intelligence continues to evolve, vigilance is essential. The security of using platforms like OpenClaw depends on the conscious choice of skills to avoid falling victim to digital fraud. User awareness of attack methods and necessary precautions will be vital for protection against malware in the future.
Content selected and edited with AI assistance. Original sources referenced above.
