Security Advisory: OpenClaw Official Plugin Center ClawHub Targeted in Large-Scale Malicious Skill Poisoning Campaign

By: theblockbeats.news|2026/03/30 10:55:46
0
Share
copy

BlockBeats News, February 9th, SlowMist issued a security advisory. Recently, the open-source artificial intelligence agent project OpenClaw unexpectedly gained popularity. Its official plugin center, ClawHub, is gradually becoming a new target for supply chain poisoning attacks, posing a potential security risk to developers and users. Monitoring shows that 341 malicious skills have been identified, which usually masquerade as cryptocurrency assets, security checks, or automation tools.

Attackers use the SKILL.md file as the entry point for execution instructions, hiding malicious commands through Base64 encoding and employing a two-stage loading mechanism to evade detection. The first stage retrieves the payload via curl, and the second stage deploys a sample named dyrtvwjfveyxjf23, deceiving users into entering their system password and stealing local documents and system information. Users are advised to review any command requiring execution, be cautious of prompts to obtain system privileges, and always prefer obtaining tools through official channels.

You may also like

Champion's Final Bow: FC Barcelona vs Real Betis – Celebrate the Title with a Home Finale

FC Barcelona are champions! After beating Real Madrid to clinch the 2025-26 LALIGA title, Barça return home to face Real Betis on May 17. A victory party at Spotify Camp Nou awaits. Full preview inside.

Best Oil Trading Platform for Crypto Users in 2026

Looking for the best oil trading platform for crypto users? Trade crude oil, gold, forex, and US stock futures directly with USDT on WEEX TradFi with 0% trading fees and no broker account required.

5 Futures Trading Strategies Smart Traders Use to Cut Crypto Fees and Boost Futures Returns

Most futures traders focus on entries and exits but ignore the fees quietly killing profits. Learn 5 futures trading strategies to cut costs and improve returns in 2026.

What Is TradFi? How Crypto Traders Can Now Access Crude Oil, Gold, and Global Markets

What is TradFi in crypto? Learn how crypto traders can now trade crude oil, gold, stocks, and global markets directly with USDT on WEEX TradFi with 0 fee trading and a $150,000 bonus pool.

How WEEX Bridges Crypto and Football: A Deep Look at the LALIGA Partnership Inside the WEEX App

WEEX is not just a LALIGA sponsor. It’s a true partner. From iPhone Dynamic Island to LALIGA-themed app icons and smart posters, see how WEEX brings football passion into every trade — and builds a real bridge between crypto and sports.

FC Barcelona vs Real Madrid Preview: El Clásico – Can Barça Clinch the Title at Spotify Camp Nou?

FC Barcelona vs Real Madrid El Clásico match preview for May 11, 2026. Barça need just 1 point to win LALIGA. Can Madrid delay the trophy? Full preview inside.

Popular coins

Latest Crypto News

Read more
iconiconiconiconiconiconicon
Customer Support:@weikecs
Business Cooperation:@weikecs
Quant Trading & MM:bd@weex.com
VIP Program:support@weex.com