Cybersecurity researchers disclosed they’ve detected a case of an data stealer an infection efficiently exfiltrating a sufferer’s OpenClaw (previously Clawdbot and Moltbot) configuration surroundings.
“This discovering marks a big milestone within the evolution of infostealer habits: the transition from stealing browser credentials to harvesting the ‘souls’ and identities of private AI [artificial intelligence] brokers,” Hudson Rock stated.
Alon Gal, CTO of Hudson Rock, advised The Hacker Information that the stealer was possible a variant of Vidar based mostly on the an infection particulars. Vidar is an off-the-shelf data stealer that is identified to be energetic since late 2018.
That stated, the cybersecurity firm stated the information seize was not facilitated by a customized OpenClaw module inside the stealer malware, however reasonably by a “broad file-grabbing routine” that is designed to search for sure file extensions and particular listing names containing delicate information.
This included the next recordsdata –
- openclaw.json, which comprises particulars associated to the OpenClaw gateway token, together with the sufferer’s redacted e-mail handle and workspace path.
- gadget.json, which comprises cryptographic keys for safe pairing and signing operations inside the OpenClaw ecosystem.
- soul.md, which comprises particulars of the agent’s core operational rules, behavioral tips, and moral boundaries.
It is price noting that the theft of the gateway authentication token can permit an attacker to connect with the sufferer’s native OpenClaw occasion remotely if the port is uncovered, and even masquerade because the consumer in authenticated requests to the AI gateway.
“Whereas the malware could have been searching for commonplace ‘secrets and techniques,’ it inadvertently struck gold by capturing all the operational context of the consumer’s AI assistant,” Hudson Rock added. “As AI brokers like OpenClaw develop into extra built-in into skilled workflows, infostealer builders will possible launch devoted modules particularly designed to decrypt and parse these recordsdata, very like they do for Chrome or Telegram as we speak.”
The disclosure comes as safety points with OpenClaw prompted the maintainers of the open-source agentic platform to announce a partnership with VirusTotal to scan for malicious abilities uploaded to ClawHub, set up a risk mannequin, and add the power to audit for potential misconfigurations.
Final week, the OpenSourceMalware staff detailed an ongoing ClawHub malicious abilities marketing campaign that makes use of a brand new approach to bypass VirusTotal scanning by internet hosting the malware on lookalike OpenClaw web sites and utilizing the abilities purely as decoys, as an alternative of embedding the payload immediately of their SKILL.md recordsdata.
“The shift from embedded payloads to exterior malware internet hosting exhibits risk actors adapting to detection capabilities,” safety researcher Paul McCarty stated. “As AI talent registries develop, they develop into more and more enticing targets for provide chain assaults.”
One other safety drawback highlighted by OX Safety issues Moltbook, a Reddit-like web discussion board designed solely for synthetic intelligence brokers, primarily these working on OpenClaw. The analysis discovered that an AI Agent account, as soon as created on Moltbook, can’t be deleted. Which means that customers who want to delete the accounts and take away the related information haven’t any recourse.
What’s extra, an evaluation printed by SecurityScorecard’s STRIKE Risk Intelligence staff has additionally discovered tons of of 1000’s of uncovered OpenClaw cases, possible exposing customers to distant code execution (RCE) dangers.
 |
| Faux OpenClaw Web site Serving Malware |
“RCE vulnerabilities permit an attacker to ship a malicious request to a service and execute arbitrary code on the underlying system,” the cybersecurity firm stated. “When OpenClaw runs with permissions to e-mail, APIs, cloud companies, or inside sources, an RCE vulnerability can develop into a pivot level. A nasty actor doesn’t want to interrupt into a number of methods. They want one uncovered service that already has authority to behave.”
OpenClaw has had a viral surge in curiosity because it first debuted in November 2025. As of writing, the open-source mission has greater than 200,000 stars on GitHub. On February 15, 2026, OpenAI CEO Sam Altman stated OpenClaw’s founder, Peter Steinberger, could be becoming a member of the AI firm, including, “OpenClaw will stay in a basis as an open supply mission that OpenAI will proceed to assist.”
