OpenClaw Malicious Skill Trap

Summary

Bitdefender Labs reports that hostile OpenClaw Skills are being abused to fetch and run malware, with a clear focus on stealing crypto-wallet data and user credentials. Roughly 17% of reviewed Skills exhibited malicious intent, often by cloning common utilities and hiding execution behind obfuscated shell commands. Stagers are frequently parked on paste sites and served from a repeatedly used IP address. Observed end payloads include the macOS AMOS Stealer infostealer.

Investigation

Researchers reviewed a broad corpus of OpenClaw Skills and found recurring tradecraft: Base64-wrapped commands, remote script pulls from glot.io and GitHub across multiple repos, and reliance on a single IP for hosting malicious binaries. They mapped specific Skill paths and reconstructed the execution chain that ultimately downloads AMOS Stealer. Other samples delivered AuthTool.exe for Windows and credential-exfiltration backdoors masquerading as backup or recovery tools.

Mitigation

Treat OpenClaw Skills as untrusted software: validate any external download, avoid running Skills that ask for elevated rights or direct access to secrets, and require code review for community additions. Use endpoint protection that flags suspicious command execution and remote script retrieval. Keep private keys and API tokens in hardened, isolated stores rather than on user endpoints.

Response

When a malicious Skill is identified, isolate the system, stop spawned processes, and block the associated IP and domains. Perform forensics to locate and remove retrieved payloads, including AMOS Stealer. Reset exposed credentials—especially wallet keys and API secrets—and monitor for suspicious logins or unauthorized transactions.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  The attacker has compromised a victim’s machine and installed the OpenClaw service (malicious backdoor). To avoid detection, the adversary stores its payload in a Base64‑encoded file (payload.b64). Using the legitimate base64 utility, OpenClaw decodes the file and pipes it directly to the interpreter (/bin/bash). Because the command line includes the literal string base64 -d, the Sigma rule should fire.

  1. Place the encoded payload on the target:

     echo "ZWNobyAiTWFsaWNpb3VzIFBheWxvYWQi" > /opt/openclaw/payload.b64

  2. Start the OpenClaw process that performs the decode (simulated here by directly invoking openclaw binary).

     /usr/local/bin/openclaw -c "base64 -d /opt/openclaw/payload.b64 | /bin/bash"

  3. The decoded command (echo "Malicious Payload") runs, demonstrating the intended malicious action.

• Regression Test Script:

  #!/usr/bin/env bash
  set -euo pipefail
  
  # 1. Setup: create a dummy OpenClaw binary (placeholder for real malware)
  OPENCLAW_PATH="/usr/local/bin/openclaw"
  if [[ ! -f "$OPENCLAW_PATH" ]]; then
      cat <<'EOF' > "$OPENCLAW_PATH"
  #!/usr/bin/env bash
  # Simple wrapper that executes the command passed via -c
  while [[ $# -gt 0 ]]; do
      case "$1" in
          -c) shift; eval "$1";;
          *) shift;;
      esac
  done
  EOF
      chmod +x "$OPENCLAW_PATH"
  fi
  
  # 2. Create a base64‑encoded payload
  PAYLOAD_FILE="/opt/openclaw/payload.b64"
  mkdir -p "$(dirname "$PAYLOAD_FILE")"
  echo "ZWNobyAiTWFsaWNpb3VzIFBheWxvYWQi" > "$PAYLOAD_FILE"
  
  # 3. Execute OpenClaw with the decode command (this should trigger the rule)
  "$OPENCLAW_PATH" -c "base64 -d $PAYLOAD_FILE | /bin/bash"
  
  # 4. Output marker for manual verification
  echo "[+] OpenClaw decode execution completed."

• Cleanup Commands:

  #!/usr/bin/env bash
  set -euo pipefail
  
  # Remove dummy OpenClaw binary
  sudo rm -f /usr/local/bin/openclaw
  
  # Remove payload file and directories
  sudo rm -rf /opt/openclaw
  
  # Remove any audit rules added for the test (optional – restore to original state)
  sudo auditctl -D
  
  echo "[+] Cleanup finished."