Acronis says 575 malicious OpenClaw skills sit with 13 accounts; other firms count differently

Two of the 13 accounts hold 533 of Acronis's 575 skills, and the count is dated 30 April

The Acronis Threat Research Unit (TRU) says that, "as of this writing", it had identified 575 malicious skills in the OpenClaw ecosystem, distributed by 13 developer accounts. The post is "Poisoning the well: AI supply chain attacks on Hugging Face and OpenClaw", and its own page data dates it 30 April 2026. The post's table splits the 575 as 334 for one account and 199 for another: together 533, or 92.7 percent of the total (derived; the post's own two percentages, 58.09 and 34.61, add to the same 92.70). Six of the 13 accounts have one skill each, the median account has 2 (derived), and the average of about 44.2 per account (derived) describes no account at all. The post's own table classes the two big accounts as a primary and a secondary threat actor and the other eleven as minor actors.

That number is a count by one vendor on one date. It is not a count of installs, of victims, of skills still online today, or of anything the platforms have confirmed or removed. The post gives no method beyond saying it was measuring this activity, no date range and no total number of skills on the marketplace. It was 194 days old when this site read it (derived: 30 April to 10 November), and Acronis's Cyber Pulse 2026 launch post of 9 November 2026 repeats the two numbers as "more than 575 malicious OpenClaw skills across 13 developer accounts", 193 days after the original (derived), with no new date or method. All times and statuses below are as read between 10:45 and 10:58 UTC on Tuesday 10 November 2026.

Other firms have counted ClawHub skills too, with other methods and on other dates, and the numbers differ because the questions differ. The sections below set them side by side. Acronis sells endpoint security: its post says Acronis EDR and XDR detect and block the threats described and its first recommendation is MDR or 24/7 monitoring, which is its selling interest, stated once. The OpenClaw project and Hugging Face are platforms that the post itself says were abused; nothing read here makes either a party at fault.

What the post says happened on ClawHub, in its order

The post describes OpenClaw ("OpenClaw (formerly Moltbot, and before that, Clawdbot)") as a personal AI assistant that runs actions on a user's behalf through installable skills from ClawHub, its skill marketplace. Its own security reading is blunt: the skill model "essentially grants AI the power to run external code with elevated access rights". The campaign it measured targets "both Windows and macOS systems", with payloads that include trojans, cryptominers and the AMOS stealer, a macOS infostealer.

The trojanised skills, the post says, masquerade as legitimate tools but instruct users to execute encoded commands or install hidden dependencies, for example by requiring external downloads or password-protected installers. It calls the key technique indirect prompt injection: hidden instructions that make an AI agent carry out actions for the user. It also says "This campaign doesn't compromise AI agents themselves" and that "the AI agents are working as intended". The weakness it describes is the trust between a person, the agent and the skill's text.

Zoom

The post follows two example skills. In the first, a skill that fetches and summarises video transcripts says a helper must be installed first. Its SKILL.md tells the reader to download a password-protected archive and install the helper for Windows, or to run a command on macOS. The post calls the archive "a technique to evade security solutions". On VirusTotal the Windows binary "is detected as a Trojan by multiple security vendors" and is packed with VMProtect.

The macOS command prints a decoy message and then runs a base64 encoded string that hides the real command. Decoded, the post says, it fetches a script from one IP address, which it calls "the centralized host used to distribute macOS payloads across the malicious skills". That script downloads a second file into the temporary directory, clears its quarantine attributes, makes it executable and runs it. The post identifies the second file as AMOS Stealer, which it says is "commonly sold as malware-as-a-service (MaaS) through Telegram and underground forums". This site does not print the encoded string or the command lines: the post prints them, and a reader who needs them can take them from the post.

The second example is quieter. A skill whose archive had "almost no antivirus detections at the time of analysis" had a SKILL.md that, the post says, showed no signs of prompt injection. The package carried an extra text file, named in the post, telling the reader to download an external archive from a file hosting site, a step the post says "targets the user instead of the AI agent". The Windows binary inside decrypts its strings at runtime with a fixed 30 byte XOR key, decrypts an embedded payload with AES in CBC mode and runs it from memory. The process tree launches browsers and then a PowerShell command that, per the post, adds Defender exclusion paths, creates scheduled tasks that start at logon and talks to its command server over an AES encrypted channel on HTTPS. What comes back is saved as a file masquerading as a system process, and the post says its behaviour is "consistent with a cryptominer". The post also found a Telegram bot used as a dead drop to hide the real command server, and related samples tied to fake VPN landing pages.

Zoom

Hugging Face: a limited set, described as indicative

The post's Hugging Face section is a separate story from the 575 skills. Acronis says it found "a limited, yet notable set of Spaces, datasets and models" used to host payloads or as a staging point, with malware types including "infostealers, loaders, RATs, trojans and other malicious implants" for Windows, Linux and Android. It gives no count of repositories. It also cautions that "these observations should be interpreted as indicative of ongoing abuse rather than a comprehensive assessment" and that "The true scale of this activity is likely higher but requires further and deeper investigation".

Two campaigns are described. ITHKRPAW, which the post says it identified in January, targets "organizations in the financial sector and entities in Vietnam". A shortcut file reaches a PowerShell script through a Cloudflare Workers endpoint, which pulls the real payload from a Hugging Face dataset repository and opens a harmless picture as a decoy. The post assesses "with moderate confidence that the PowerShell script has been generated by an LLM", citing comments in Vietnamese. FAKESECURITY, the post's name for a second cluster, starts from a batch script seen in the wild in January that fetches another batch script from a Hugging Face repository, then injects into the Windows shell process in memory. Acronis says "we cannot confirm at this point whether this is part of a broader campaign targeting any specific entity, or just opportunistic activity".

The post does not tie either Hugging Face campaign to the 575 ClawHub skills. In its ClawHub section, which runs from the skill count to the cryptominer, no skill is shown fetching anything from Hugging Face; the staging places it names there are an IP address, GitHub release files, paste services and a file host. A reader who sees one headline about both platforms should not assume one chain. This site did not open any Hugging Face repository and has found no Hugging Face statement about the post. One related fact from the platform side: OpenClaw's own post of 1 June 2026 says it publishes ClawHub's security scan outcomes as a public dataset on Hugging Face, and the VirusTotal post of 7 February 2026 says VirusTotal already protects the Hugging Face ecosystem with hash lookups. Neither is about the Acronis findings.

How the 575 divide across the 13 accounts

The post prints all 13 account names. This site does not reproduce them, because a name would point a reader at the accounts and their uploads. The table keeps the order, counts, percentages and labels as the post prints them, with the names replaced by numbers.

Derived: the 13 counts sum to 575, and 11 of the 13 accounts are labelled minor. The two big accounts hold 533 skills (92.7 percent); the other 11 hold 42 between them (7.3 percent). A reader who treats 575 as the work of 13 equal publishers has the wrong picture, and a reader who treats it as one operator's work has not been told so by the post: it labels the two big accounts as two threat actors and does not say whether any of the accounts are linked.

The count also has a history. Bitdefender Labs, in a post dated 5 February 2026, 84 days before the Acronis post (derived), says one account is associated with 199 such skills, the same figure the Acronis table prints for its second row, and lists example skill paths under the alias that Acronis ranks first. That does not show the two vendors counted the same skills. It does show that a share of the 575 was already on the public record in February, and the Acronis post does not say how much of its count is new.

The count depends on who counted and when

No page read here counts the same thing as another. Bitdefender's is a share of skills it analysed in one week. Acronis's is a vendor's tally. OpenClaw's is a verdict from its own scanning pipeline. Unit 42 has two pages: one asks how many skills carry attack chains (a static analysis, with candidates rather than confirmed malware), the other lists five skills that got past screening. The numbers are different measurements, not rival answers to one question, and the table says what each page states about its method.

Zoom

A share of the registry is tempting and unsafe. Dividing Acronis's 575 by Unit 42's 49,943 skills gives about 1.15 percent (derived), but the two numbers come from different dates and different methods, and OpenClaw's own dataset of 1 June counts 67,453 rows against Unit 42's 49,943 skills from an earlier crawl. On OpenClaw's figures, 206 of 67,453 rows is about 0.31 percent (derived). None of these is the share of ClawHub that was malicious on any one day, and the Acronis post gives no registry total to divide by.

Two things the pages do agree on. The same IP address, 91.92.242[.]30, is printed by Bitdefender on 5 February, by Acronis on 30 April and by Unit 42 on 23 June, where Unit 42 says it is "continuing to receive new skill deliveries" more than three months after first public disclosure. And a flag is not a verdict: OpenClaw's post of 30 April says its team closed more than 700 ClawHub moderation issues in a month, around 460 of them rescan appeals from authors whose work the automated suspicious flag had wrongly caught. A count of flagged skills and a count of malicious skills can differ for that reason alone.

Whether the 575 include or overlap the 341, the Bitdefender set or the 206 is not stated on any page read. A figure of about 314 flagged skills turned up in search results; it is on none of the pages this site read, so it is not used.

Friendly labels doing the work of a control

Three labels in this story carry more trust than the evidence gives them. "Official repository". Acronis advises downloading skills "only from verified sources and official repositories". The skills in its count are described as ClawHub skills, that is, listings on the marketplace built for OpenClaw skills, so a marketplace listing is not the same as a verified source.

"Scanned". OpenClaw's post of 7 February 2026 says all skills are scanned by VirusTotal and says in the same post "A clean scan doesn't mean a skill is safe". Acronis says its second example had almost no antivirus detections when it analysed it, and Unit 42 says of its five cases "Each case passed existing detection tools at the time of our analysis". On 1 June OpenClaw reported that its three scanners barely overlap: 468 skills, 0.69 percent of the 67,453 rows, were flagged by all three at once, and 81.9 percent of positive findings came from a single scanner.

"Skill". The word suggests a small helper. Unit 42 describes skills as "markdown-driven packages with broad local system access". In the post's examples the dangerous part is text that tells a person or an agent to do something. In the second example the lure sat in a plain text file beside the skill and was aimed at the person, not the agent. That matters for controls: a check that reads only the instruction file the agent follows would miss it, and a check that blocks agents would not stop a person who follows the text.

What Acronis states, and what it does not

The Qilin ransomware coverage that sits near this story is a separate matter. In the post it is only the title of a related article link. The Cyber Pulse blog post lists, among its related stories, a separate Acronis analysis of Qilin dated 28 October 2026, and its own text on OpenClaw covers only skills, infostealers and exposed agent gateways. The Cyber Pulse executive summary, read in full, does not mention OpenClaw at all. This site does not link Qilin to the skills.

What to do, in order

The post's recommendations are Acronis's, and several point to products Acronis sells. The second list is this site's suggestion and comes from reading the post's mechanism, not from the post.

Technical details

The post prints indicators in two tables, a hash list and a list of hosts, and its analysis text prints some artefacts of its own. This section reproduces them as the post prints them, each attributed to Acronis, and marks what this site derived. It leaves out the encoded commands, the install lines, the names of accounts, skills and repositories, and the full addresses of paste pages and GitHub release files, because those would route a reader to the malicious items. No skill text is reproduced beyond the pattern described above. The post prints no query, detection rule or configuration; it names behaviours to hunt (encoded PowerShell, in-memory injection, Defender exclusions, scheduled tasks, HTTPS to newly registered domains).

OpenClaw hash list (7 values). SHA256 values with the post's own descriptions. A defender can search endpoint and mail telemetry for them, or add them to a block list. A match on an archive hash means the file was present, not that it ran.

9db18aa394f554aa455f3039ce734b1653cc999089889c551fe263bd4bdc39fc  OpenClaw Skill Archive
122bea967f4c194fd5820123d13b7b71422c31f92b9fc0b0fa05aac3ff03dfaa  OpenClaw Skill Archive
d781d5cabaf5f305bbb8afcd9a54d7ba616bfa7aef5c4d16f6bce3d2bf3b4073  Second-stage dropper
f0a54f2b44e557854b0a5001c4e10185884af945814786f78b86539014f78a16  AMOS Stealer
fd3d52c2bb3764aabfe4da301967bfbc18e1c062d5dad2e9f4c3b6b6cf0ec9f8  ClawHub-DependencyInstaller.zip
89930bd18e0f9c9c98dfb1662cb87aa98348e87164ab62b1f39e86ebf2ce24cb  ClawHub-DependencyInstaller.exe (Loader)
c7b93b6facfc23f49e35e81dc9c30cc69401b8245eeb7c032fc13656cd7e101f  Cryptominer Payload

Hugging Face hash list (5 values). The post prints file names for these. They belong to the ITHKRPAW and FAKESECURITY campaigns, not to the ClawHub skills.

b5da6ffa5f85aa5016fbc02a3122361c85d21192c45df9544099d13e6ff84c36  Bao_Cao_Tai_Chinh_2024.pdf.lnk
e84b1e2c432b2394c403b524b8361ffa9923a022eb05215f1dc811bc167c3c5e  CDC1.bat
d42aecf76fb1531cd5b7139e669910b2fd82a90b7e11448128e226775bf5d42e  xt53.bat
579a82dde4425d95e20a22171be0a37702c833fdca6e5e04f69099a025863136  StartGD22OR21.bat
462af0a3a9094d44c30cc65544ec1171a62365cff09e67f5e87e061a3d604bd0  WindowsDefender.exe

Hosts (defanged). The post's address table has 11 rows: one IP address, two paste snippet addresses on one service, one paste page on another, five GitHub release file addresses, one cryptominer command domain and one Telegram dead drop. Only the two infrastructure rows are printed in full here; the paste services and Telegram appear as host names only, and the five GitHub addresses are not reproduced because each names an account. Unit 42's page of 23 June 2026 also lists the same IP address, the decoy host below and a paste service host among its indicators. A defender can block or alert on these hosts and search proxy and DNS logs back to at least February 2026, when Bitdefender printed the address.

91.92.242[.]30        Malware C2 server for macOS payloads
velvet-parrot[.]com   C2 server delivering the cryptominer payload
glot[.]io             host only: two paste snippets in the post's table, macOS intermediary sites
rentry[.]co           host only: one paste page in the post's table, macOS intermediary sites
t[.]me                host only: one Telegram dead drop (DDR) in the post's table
install[.]app-distribution[.]net   host named in the macOS decoy message, not in the post's table

Behavioural artefacts. The post's PowerShell builds names from joined fragments; this site joined them, so the first group is derived. Hunt for the Defender exclusion key, tasks with those names that run at logon, and processes called svchost.exe or RuntimeBroker.exe running from those folders rather than from the Windows system folders. The second group is printed whole in the post's FAKESECURITY analysis.

Cryptominer chain, joined by this site from the fragments in the post's PowerShell:
  Defender exclusion key: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths
  Scheduled tasks:        WindowsSystemService ; RuntimeBrokerService
  Hidden folders under the user's local app data:
    \Microsoft\OfficeBroker
    \Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp
  Copies named svchost.exe and RuntimeBroker.exe (run with -Embedding)

FAKESECURITY, as printed:
  Hidden folder:   %APPDATA%\Microsoft\OQvoig1QLXmD
  Copy of itself:  vZJY8wQTBDxEtilj.bat
  Run key value:   5PthNvuYXu under HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  Mutex:           was_s2Pd8zz_Mtx
  Payload marker:  ::rusy4bgJy8LXXbkz::
  Single byte XOR key: 0xF1

The question the count leaves open

If a vendor counts 575 skills on 30 April, repeats it on 9 November, and two accounts account for 533 of them, who tells a user of the marketplace today which skills are live, which were removed, and how many people ran one? The platform scans and flags, the vendors count and publish, and no page read here joins those numbers into one answer for the person deciding whether to install a skill tonight.

Key facts