DIGGINGBEAGLE

Case · DiggingBeagle record

ClawHavoc weaponized OpenClaw skills to deliver wallet-stealing malware

Trellix documented ClawHavoc, a malicious-skill supply-chain campaign targeting OpenClaw's ecosystem. More than 350 malicious or typosquatted skills were identified; instructions could lead agents or users toward malware installation, and the delivered stealer targeted more than 60 cryptocurrency wallets. Trellix emphasized that the OpenClaw issues it reproduced were associated mainly with older releases and were absent from current versions at publication.

Agent-enabled software supply-chain attackIndirect prompt injection

Assessment profile

Assessment method
Setting
production
Exploitation
not established
Remediation
fixed reported
AI role
AGAINST AI
Basis and provenance

Trellix's recorded claims describe distributed malicious skills and wallet-stealer targeting. Reproduced issues are said absent from current versions at the historical publication cutoff; this is a reported, scoped fix, not a fresh verification or victim-loss estimate. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded. Stored evidence uses source-level locators; passage-level corroboration remains required.

Assessed Sep 24, 2026 using diggingbeagle.assessment/1.

Evidence basis: CLM-PATH · CLM-SCALE · CLM-SKILLS · CLM-VERSION · CLM-WALLETS · CLM-WALLETS2 · Trellix - OpenClaw supply-chain crisis / ClawHavoc

At a glance

Mechanism and trust boundary

  1. 01

    Publish or typosquat an OpenClaw skill

    Attackers place malicious skills where users or agents can install or select them.

    Boundary: skill ecosystem / local agent configuration

  2. 02

    Skill instructions request host actions

    Malicious instructions leverage the agent framework's ability to run commands or guide installation steps.

    Boundary: declarative skill text / executable host authority

  3. 03

    Malware is downloaded or executed

    The workflow delivers credential- and wallet-stealing malware to the host.

    Boundary: agent action / endpoint compromise

  4. 04

    Local secrets become attacker targets

    The stealer targets credentials and more than 60 cryptocurrency wallet applications or extensions.

    Boundary: compromised endpoint / account and wallet secrets

Timeline

  1. Aug 19, 2026
    Event type unspecified

    Trellix publishes ClawHavoc research

    The report describes more than 350 malicious or typosquatted skills and the associated wallet-stealing payload.

Claims & evidence

CLM-PATHThe attack path combined malicious skill instructions with host-level command execution and malware delivery, exploiting the fact that agent frameworks can act directly on the operating system.supported

Basis: reported finding

Link to claim
CLM-SCALETrellix identified more than 350 malicious or typosquatted skills in the ClawHub/OpenClaw ecosystem.supported

Basis: reported finding

Link to claim
CLM-SKILLSTrellix identified more than 350 malicious or typosquatted OpenClaw skills in the ClawHavoc campaign.supported

Basis: reported finding

Link to claim
CLM-VERSIONTrellix stated that the specific OpenClaw issues it reproduced were principally from older releases and were not present in current versions at publication.supported

Basis: reported finding

Link to claim
CLM-WALLETSTrellix says the delivered stealer targeted more than 60 cryptocurrency wallets.supported

Basis: reported finding

Link to claim
CLM-WALLETS2The stealer targeted more than 60 cryptocurrency wallets, including MetaMask, Phantom, Exodus and Electrum.supported

Basis: reported finding

Link to claim

Implications

Agent extensions should be treated like executable packages, not like harmless prompt templates. When a skill can cause shell execution, its instructions participate directly in the host security boundary. Marketplace identity, code provenance, permission review and runtime containment therefore matter as much as model prompt defenses.

Controls and mitigations

  • Use signed or otherwise authenticated skill provenance and review publisher identity before installation.
  • Require explicit permissions for shell execution, downloads and access to wallet or credential locations.
  • Run untrusted skills in constrained environments with least-privilege filesystem and network access.
  • Keep OpenClaw and related components current; Trellix reported that reproduced issues were concentrated in older releases.

Unknowns and contradictions

  • The report does not establish a complete victim count or aggregate cryptocurrency loss.

Sources and citation

EvidenceTrellix - OpenClaw supply-chain crisis / ClawHavoc

Material revision history

  1. Sep 18, 2026 · Published version · first publication · revision 4
  2. Sep 19, 2026 · Published version · material revision · revision 17Public fields changed: attack_path, implications, mitigations, narrative, timeline
  3. Sep 25, 2026 · Published version · material revision · revision 37Public fields changed: assessment_profile
  4. Oct 8, 2026 · Published version · material revision · revision 99Public fields changed: claims
Record metadata

Canonical ID: CASE-2026-CLAWHAVOC · revision 99

Legacy date (semantics unspecified): 2026-08-19. This value is not treated as an occurrence or disclosure date.