ClawHavoc: The AI Agent Supply Chain Attack You Need to Know About
- Patrick Duggan
- Feb 13
- 4 min read
Updated: Aug 11
# ClawHavoc: The AI Agent Supply Chain Attack You Need to Know About
**Published:** February 14, 2026
The Attack
Between January 27-29, 2026, threat actors uploaded **341 malicious skills** to ClawHub, the community marketplace for OpenClaw AI agents.
**9,000+ installations compromised in 72 hours.**
The payload? **AMOS (Atomic Stealer)** - an information-stealing malware targeting macOS and Windows that harvests:
- Crypto wallet private keys
- Browser passwords
- SSH credentials
- API keys
- Session tokens
The attack vector is elegant and terrifying: users install what looks like a legitimate skill - maybe `solana-wallet-tracker` or `youtube-summarize-pro`. The skill's documentation looks professional. But there's a "Prerequisites" section that instructs users to run a terminal command to "fix the environment."
That command installs AMOS.
The Infrastructure
**C2 Server:** `91.92.242.30`
| Detail | Value |
|--------|-------|
| ASN | AS202412 |
| Provider | Omegatech LTD |
| Registration | Seychelles (bulletproof hosting) |
| VirusTotal | 22/93 malicious |
| Spamhaus | DROP listed (SBL686267) |
The parent network `91.92.240.0/22` is **already in our STIX feed** via Spamhaus DROP integration.
The Threat Actors
| Account | Created | Activity |
|---------|---------|----------|
| `hightower6eu` | Jan 20, 2026 | **354 malicious packages** (repos now deleted) |
| `davidsmorais` | Oct 2016 | Compromised legit account - mixed clean/malicious uploads |
Koi Security identified 14 accounts contributing malicious content. The pattern suggests both fresh throwaway accounts AND compromised legitimate accounts from years ago.
CVE-2026-25253: The 1-Click RCE
Even if you avoided ClawHub entirely, OpenClaw had a critical vulnerability:
**CVE-2026-25253** - Incorrect Resource Transfer Between Spheres
- **CVSS:** 8.8 (High)
- **Exposed instances:** 17,500+
- **Attack:** Malicious link with `?gatewayUrl=attacker.com/ws` forces token exfiltration
- **Impact:** Full RCE on victim's machine
The vulnerability exploits a logic flaw where OpenClaw accepts a gateway URL via query string and establishes a WebSocket connection WITHOUT user confirmation, transmitting authentication credentials.
**Even localhost users are vulnerable** - the attack uses the victim's browser to pivot into the local network.
Patched in v2026.1.29 (February 3, 2026).
What We're Blocking Right Now
Our STIX feed currently contains **1,251 indicators** from the last 24 hours:
| Malware Family | Active C2s | Threat Type |
|----------------|-----------|-------------|
| Cobalt Strike | 29 | Post-exploitation framework |
| Meterpreter | 2 | Remote access |
| Latrodectus | 1 | Loader malware |
| BianLian | 1 | Ransomware |
| Adaptix C2 | Active | Command & control |
| VShell | Active | Backdoor |
| LokiPWS | Active | Password stealer |
Plus:
- **Spamhaus DROP/EDROP** - Hijacked networks (including the ClawHavoc ASN)
- **ThreatFox** - Certificate anomaly detection
- **OTX Integration** - Community pulses
- **Zero-abuse "ghosts"** - Threats we catch that nobody else sees
The Bigger Picture
This week's threat landscape:
| Threat | Status | Our Coverage |
|--------|--------|--------------|
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
| ClawHavoc (AI Agents) | Active | ASN blocked via Spamhaus |
| Notepad++ Supply Chain | Active | 29 Cobalt Strike C2s |
| Microsoft 6 Zero-Days | Patch Tuesday | Ransomware IOCs |
| CVE-2026-25253 (OpenClaw) | Patched | Infrastructure blocked |
| Ivanti EPMM RCE | Active | IOCs indexed |
The theme is clear: **supply chain attacks are the #1 vector in 2026.**
Your text editor might be compromised (Notepad++). Your AI agent plugins might be compromised (OpenClaw). Your CI/CD dependencies might be compromised (the npm/PyPI attacks continue).
Get On The Feed
**STIX 2.1 Feed (Free):**
**Parameters:**
- `?days=7` - Last 7 days
- `?days=30` - Last 30 days
- `?malware=cobalt_strike` - Filter by family
**Who's Already Using It:**
- Microsoft
- AT&T
- Lumen
**What You Get:**
- 1,000+ indicators daily
- Cobalt Strike, Meterpreter, AMOS, Latrodectus coverage
- Spamhaus DROP/EDROP (bulletproof hosting networks)
- ThreatFox certificate anomalies
- MITRE ATT&CK mapping
Recommendations
1. **If you use OpenClaw:** Update to v2026.1.29+ immediately. Rotate all tokens. Audit installed skills.
2. **If you use Notepad++:** Check for compromise indicators. Our Cobalt Strike C2 list covers the payload infrastructure.
3. **If you run AI agents:** Treat skills/plugins like npm packages - verify publishers, check for typosquatting, sandbox execution.
4. **For everyone:** Get on the feed. Block the beacons.
Sources
- [The Hacker News: 341 Malicious ClawHub Skills](https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html)
- [VirusTotal Blog: OpenClaw Weaponization](https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html)
- [SOCRadar: CVE-2026-25253](https://socradar.io/blog/cve-2026-25253-rce-openclaw-auth-token/)
- [Snyk: SKILL.md to Shell Access](https://snyk.io/articles/skill-md-shell-access/)
- [Bitdefender: OpenClaw Enterprise Exploitation](https://businessinsights.bitdefender.com/technical-advisory-openclaw-exploitation-enterprise-networks)
- [Koi Security: ClawHavoc Analysis](https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting)
*The AI agent era has its first major supply chain attack. 9,000 compromised in 72 hours. The infrastructure is in our feed. Block it.*
*Her name was Renee Nicole Good.*
*His name was Alex Jeffery Pretti.*
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=clawhavoc-the-ai-agent-supply-chain-attack-you-need-to-know-about
Comments