← all advisories

SKA-2026-0001

critical · type: malicious · published 2026-07-22T00:00:00Z · modified 2026-07-31T21:10:00Z

ClawHavoc campaign 'auto-updater' skills on ClawHub drop the Atomic macOS Stealer (AMOS) via password-protected archives and glot.io scripts.

Behaviors

• malware-dropper
• credential-theft
• data-exfiltration

Artifacts

References

• https://www.koi.ai/blog/clawhavoc-341-malicious-clawedbot-skills-found-by-the-bot-they-were-targeting (REPORT)
• https://www.antiy.net/p/clawhavoc-analysis-of-large-scale-poisoning-campaign-targeting-the-openclaw-skill-market-for-ai-agents/ (REPORT)
• https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html (REPORT)
• https://www.prplbx.com/blog/clawhavoc-ai-supply-chain-attack (ARTICLE)