Cybersecurity researchers disclosed they’ve detected a case of an data stealer an infection efficiently exfiltrating a sufferer’s OpenClaw (previously Clawdbot and Moltbot) configuration surroundings.
“This discovering marks a big milestone within the evolution of infostealer conduct: the transition from stealing browser credentials to harvesting the ‘souls’ and identities of private AI [artificial intelligence] brokers,” Hudson Rock stated.
Alon Gal, CTO of Hudson Rock, informed The Hacker Information that the stealer was probably a variant of Vidar primarily based on the an infection particulars. Vidar is an off-the-shelf data stealer that is recognized to be energetic since late 2018.
That stated, the cybersecurity firm stated the info seize was not facilitated by a customized OpenClaw module throughout the stealer malware, however somewhat by way of a “broad file-grabbing routine” that is designed to search for sure file extensions and particular listing names containing delicate information.
This included the next recordsdata –
- openclaw.json, which incorporates particulars associated to the OpenClaw gateway token, together with the sufferer’s redacted e mail handle and workspace path.
- gadget.json, which incorporates cryptographic keys for safe pairing and signing operations throughout the OpenClaw ecosystem.
- soul.md, which incorporates particulars of the agent’s core operational rules, behavioral pointers, and moral boundaries.
It is price noting that the theft of the gateway authentication token can enable an attacker to hook up with the sufferer’s native OpenClaw occasion remotely if the port is uncovered, and even masquerade because the shopper in authenticated requests to the AI gateway.
“Whereas the malware might have been on the lookout for customary ‘secrets and techniques,’ it inadvertently struck gold by capturing your entire operational context of the consumer’s AI assistant,” Hudson Rock added. “As AI brokers like OpenClaw develop into extra built-in into skilled workflows, infostealer builders will probably launch devoted modules particularly designed to decrypt and parse these recordsdata, very like they do for Chrome or Telegram at the moment.”
The disclosure comes as safety points with OpenClaw prompted the maintainers of the open-source agentic platform to announce a partnership with VirusTotal to scan for malicious abilities uploaded to ClawHub, set up a risk mannequin, and add the flexibility to audit for potential misconfigurations.
Final week, the OpenSourceMalware crew detailed an ongoing ClawHub malicious abilities marketing campaign that makes use of a brand new approach to bypass VirusTotal scanning by internet hosting the malware on lookalike OpenClaw web sites and utilizing the abilities purely as decoys, as a substitute of embedding the payload immediately of their SKILL.md recordsdata.
“The shift from embedded payloads to exterior malware internet hosting exhibits risk actors adapting to detection capabilities,” safety researcher Paul McCarty stated. “As AI talent registries develop, they develop into more and more engaging targets for provide chain assaults.”
One other safety downside highlighted by OX Safety issues Moltbook, a Reddit-like web discussion board designed completely for synthetic intelligence brokers, primarily these working on OpenClaw. The analysis discovered that an AI Agent account, as soon as created on Moltbook, can’t be deleted. Because of this customers who want to delete the accounts and take away the related information haven’t any recourse.
What’s extra, an evaluation printed by SecurityScorecard’s STRIKE Risk Intelligence crew has additionally discovered a whole lot of 1000’s of uncovered OpenClaw cases, probably making customers prone to distant code execution (RCE) dangers.
 |
| Faux OpenClaw Web site Serving Malware |
“RCE vulnerabilities enable an attacker to ship a malicious request to a service and execute arbitrary code on the underlying system,” the cybersecurity firm stated. “When OpenClaw runs with permissions to e mail, APIs, cloud companies, or inside sources, an RCE vulnerability can develop into a pivot level. A nasty actor doesn’t want to interrupt into a number of methods. They want one uncovered service that already has authority to behave.”
OpenClaw has had a viral surge in curiosity because it first debuted in November 2025. As of writing, the open-source venture has greater than 200,000 stars on GitHub. On February 15, 2026, OpenAI CEO Sam Altman stated OpenClaw’s founder, Peter Steinberger, can be becoming a member of the AI firm, including, “OpenClaw will dwell in a basis as an open supply venture that OpenAI will proceed to help.”
