Science & Tech · Cybersecurity · 3 hrs ago
More Than 575 Malicious OpenClaw Skills Delivered Malware
Researchers identified more than 575 malicious OpenClaw skills disguised as utilities.
The packages delivered trojans, cryptocurrency miners and information-stealing software to Windows and macOS computers.
OpenClaw skills can combine instructions with code that uses permissions already granted to an AI agent.
In a separate investigation, one operator used more than 10 AI models to coordinate reconnaissance, scanning and exploitation across several countries.
The activity involved emergency services and government systems in Taiwan, universities in Thailand and telephone data collection in Mexico.
Researchers also described stolen browser sessions and developer credentials being used to access cloud services and move between systems.
Ransomware tools that disable security monitoring or delete recovery copies can make attacks harder to detect and systems harder to restore.
The findings warn that AI tools, trusted software and remote-access services can all be misused, but no specific next step is given.
Researchers identified more than 575 malicious OpenClaw skills disguised as utilities that delivered malware to Windows and macOS systems.
The packages carried trojans, cryptocurrency miners and information stealers, according to Help Net Security’s report on Acronis research.
The report said agent skills can combine instructions with executable code that uses permissions already granted to an AI agent.
It also described attacks involving AI models, stolen credentials, ransomware and tools used to interfere with detection and recovery.
- Who
- Researchers identified malicious OpenClaw skills used by cybercriminals.
- What
- More than 575 skills posing as utilities delivered trojans, cryptocurrency miners and information stealers.
- When
- The report was published on 2026-11-10. The timing of the malware activity is not stated.
- Where
- The malware targeted Windows and macOS systems. The skills’ distribution locations are not stated.
- Why
- Not stated
This story does not have two clearly opposing sides.
This story does not have a timeline yet.
- Malicious skills
- More than 575
- Target systems
- Windows and macOS
- Payloads
- Trojans, cryptocurrency miners and information stealers
- Research report
- Acronis TRU Cyber Pulse 2026