Security Advisory: OpenClaw Official Plugin Center ClawHub Targeted in Large-Scale Malicious Skill Poisoning Campaign
BlockBeats News, February 9th, SlowMist issued a security advisory. Recently, the open-source artificial intelligence agent project OpenClaw unexpectedly gained popularity. Its official plugin center, ClawHub, is gradually becoming a new target for supply chain poisoning attacks, posing a potential security risk to developers and users. Monitoring shows that 341 malicious skills have been identified, which usually masquerade as cryptocurrency assets, security checks, or automation tools.
Attackers use the SKILL.md file as the entry point for execution instructions, hiding malicious commands through Base64 encoding and employing a two-stage loading mechanism to evade detection. The first stage retrieves the payload via curl, and the second stage deploys a sample named dyrtvwjfveyxjf23, deceiving users into entering their system password and stealing local documents and system information. Users are advised to review any command requiring execution, be cautious of prompts to obtain system privileges, and always prefer obtaining tools through official channels.
You may also like

Oracle "Outage": Aave Faces $27 Million Irregular Liquidation

A single tweet caused a 17% crash in oil prices, who's not a Meme yet

March 11th Market Key Intelligence, How Much Did You Miss?

Benefit-Loaded Event | With over 500 sign-ups, how else can this Lobster Tug-of-War Extravaganza be spiced up?

a16z’s Brutal Lesson to Crypto Founders: Why Enterprises Don’t Buy the Best Technology?

The rivers and lakes are no more, Li Lin returns

Earn Up to 300% APR With WEEX Auto Earn: Limited-Time Crypto Passive Income Event
Earn up to 300% APR with WEEX Auto Earn in this limited-time crypto earning campaign. Activate Auto Earn, invite friends, and unlock additional referral crypto rewards before March 25.

BitsLab Deep Production: Nanobot User Security Practice Guide

What are the common traits of people who founded a $5 Billion+ company before the age of 23?

Why Hasn't $160 Billion Stripe Gone Public?

All the AI News You Need to Know is Here, Lyrical Officially Launches AI News Feed

Bitwise: Why Bitcoin Is Destined to Impact a Million Dollars?

Amid Geopolitical Turmoil, Tokenized Gold Emerges Alongside Round-the-Clock On-Chain Markets

Who Longs War on Polymarket?

4 AI Trading Strategy Lessons from WEEX Hackathon Finalist
Finalist Bambi shares how AI tools helped turn real trading experience into an automated strategy, why survival-first risk control shaped the system’s design, and how the approach will evolve ahead of WEEX AI Trading Hackathon Season 2.

Hong Kong Crypto Ecosystem 2.0: Stablecoins, RWA, and the New Battleground for Financial Institutions

Polymarket Arbitrage Bible: The Real Gap is in the Mathematical Infrastructure
