Malicious OpenClaw Tactics Deceive Users into Manual Password Entry for AMOS Infection

Atomic (AMOS) Stealer and OpenClaw Exploitation

Recent findings indicate that malicious OpenClaw skills are being utilized to deceive users into manually entering their passwords. This tactic forms part of a new Atomic (AMOS) Stealer infection chain that leverages AI agent workflows for social engineering purposes.

According to TrendAI™ Research, the Atomic (AMOS) Stealer has evolved from basic macOS software tactics to sophisticated supply chain attacks within the OpenClaw skill ecosystem. The current strategy involves embedding harmful instructions within SKILL.md files, using AI agents as intermediaries to guide users through seemingly legitimate but ultimately harmful setup steps.

This campaign spans multiple skill registries, with numerous malicious skills uploaded to platforms such as ClawHub and SkillsMP, often masquerading as utilities or developer tools. TrendAI™ reports that 39 analyzed skills overlap with previous ClawHavoc activities, although they differ in their focus and methods.

Advanced detection models like Claude Opus 4.5 have been successful in identifying and preventing the installation of these malicious skills. However, despite removal from primary marketplaces, the underlying code remains accessible in public GitHub repositories, posing ongoing risks for self-hosted or mirrored deployments.

The attack begins with a SKILL.md file that appears benign, declaring a dependency on “OpenClawCLI” and instructing the agent to download it from a fake distribution site. This page contains a Base64-encoded shell command that downloads and executes a remote script from an attacker-controlled IP address.

The script installs a Mach-O universal binary capable of running on both Intel and Apple Silicon devices, bypassing macOS security checks. If the user continues, a fake dialogue box requests their password, granting the stealer access to credentials and sensitive data.

The stealer targets Apple and KeePass keychains, Apple Notes, and documents in various formats, including txt, csv, json, Office files, PDFs, cfg, and KeePass vaults. The data is archived and sent to a command-and-control server via HTTPS POST requests.

This incident underscores the risks within AI agent ecosystems, highlighting the need for robust defenses against arbitrary code execution and unauthorized actions. TrendAI™ recommends combining marketplace vetting, containerized execution for agents, and behavioral detection to mitigate such threats.

Based on reporting by GBHackers.