Over 575 malicious OpenClaw skills delivered malware to Windows and macOS

A credential leak at Over malicious OpenClaw skills is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.

Cybercriminals are using AI agents to coordinate attacks, stolen credentials to access linked services, and tools that interfere with intrusion detection and system recovery, according to Acronis TRU Cyber Pulse 2026.

In an investigation known as BOSSAI, researchers documented how one operator connected more than 10 AI models to tools for reconnaissance, scanning and exploitation.

Reusable instructions carried procedures and details about targets from one campaign to the next.

Researchers identified more than 575 malicious OpenClaw skills posing as utilities.

In the Red Heron campaign, a working public exploit appeared the day after Gitea issued a patch for a critical vulnerability.

Anyone connected to Over malicious OpenClaw skills through the compromised trust relationship is potentially affected, not just Over malicious OpenClaw skills itself.

The infrastructure supported activity involving emergency services and government systems in Taiwan, universities in Thailand and telephone data collection in Mexico.

The packages delivered trojans, cryptocurrency miners and information stealers to Windows and macOS systems.

A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.

Through WeChat and LINE, the operator could assign tasks, monitor agent activity and direct concurrent operations.

Several tools were configured to run without approval prompts, allowing agents to select and execute them within their granted permissions.

The trust mechanism involved here is an API or master key, which is what let access move between otherwise unrelated systems.

Agent skills can combine instructions with executable code that uses permissions already granted to the agent.

Repository credentials and API keys can expose source code and services tied to a developer account.

Over malicious OpenClaw skills says the credential has been revoked, and no exploitation has been confirmed so far.

The Gentlemen maintained tools that affiliates could use to disable endpoint detection and response software.

If you have any integration or dependency involving Over malicious OpenClaw skills, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.

Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.

Of the more than 1.8 million endpoints already running the vendor’s own remote monitoring and management software, 63.1% had at least one more remote management or remote access tool installed.