Vidar malware steals data from AI assistant OpenClaw

Researchers from Hudson Rock discovered the first real case of data theft involving files associated with OpenClaw, an AI assistant, using Vidar malware. The attack was disclosed on October 16 and involved searching for information like "token" and "private key" on infected PCs.

OpenClaw, also known as Clawdbot and Moltbot, operates locally on users' devices, accessing files and logging into communication apps. This ability to access sensitive information has made it an attractive target for cybercriminals. The Vidar variant did not specifically target OpenClaw but found valuable data in its configuration directories.

Among the stolen information are authentication tokens, emails, public and private keys, as well as task logs and private messages from the bot. This data could allow attackers to bypass security checks and access victims' personal information.

Hudson Rock warns of a shift in cybercriminals' strategies, who now seek not only banking data but the complete digital context of victims. This includes cryptographic keys and session tokens used by advanced AI models, potentially compromising users' digital identities.

This incident highlights the growing security threat as AI assistants like OpenClaw are widely adopted for routine tasks. Protecting sensitive data is becoming increasingly critical.