Exploitation of OpenClaw and Moltbot AI Coding Agents

AI-assisted coding agents, specifically OpenClaw (formerly known as Clawdbot) and its rebranded iteration Moltbot, are being actively exploited by attackers who distribute malicious "skills" through the ClawHub registry. These agents, which operate as Node.js applications, are designed to execute shell commands to assist users with development tasks. Attackers leverage prompt injection techniques or malicious skill code to trigger unintended command execution on the host machine. Once initial access via the agent is achieved, attackers utilize common system binaries (LOLBins) and scripting interpreters to perform download-and-execute operations. These campaigns primarily target cryptocurrency wallets and sensitive credentials stored on the developer's workstation. This threat highlights the security risks inherent in the extensible plugin and skill ecosystems of AI developer tools, where third-party code is executed with the privileges of the user.

Attack Chain

1. Attacker develops or compromises a "skill" available in the ClawHub registry.
2. The target developer installs the malicious skill into their OpenClaw or Moltbot AI coding environment.
3. The agent executes the malicious skill code within the Node.js process context.
4. The malicious code triggers prompt injection or direct system command execution.
5. The Node.js process spawns a child process, such as bash, powershell.exe, or curl, to execute commands.
6. The child process downloads additional obfuscated payloads from attacker-controlled infrastructure.
7. The downloaded payload executes, targeting and exfiltrating cryptocurrency wallet files or system credentials.

Impact

Successful exploitation allows attackers to gain unauthorized command execution on the host system, leading to the theft of cryptocurrency assets and local credentials. Multiple instances of malicious skill distribution have been observed in the ClawHub ecosystem, impacting users across Windows, macOS, and Linux platforms. The shift from Clawdbot to Moltbot has also been accompanied by increased impersonation campaigns, widening the potential victim pool to include users searching for legitimate coding assistants.

Recommendation

• Audit the use of OpenClaw, Moltbot, and Clawdbot within the development environment and establish a blocklist if these tools are not approved for use.
• Implement endpoint detection to monitor for suspicious child processes spawned by Node.js, specifically targeting shells and network-fetching binaries.
• Block network traffic to identified malicious typosquatted domains (moltbot.you, clawbot.ai, clawdbot.you) at the organizational DNS resolver or firewall.
• Deploy the provided Sigma rule to detect unauthorized shell execution initiated by AI agent processes.
• Rotate secrets, API keys, and cryptocurrency wallet keys if an infected workstation is identified.