Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys
OpenClaw (ClawHub) skill users
Bitdefender found that about 17% of the OpenClaw (ClawHub) AI-agent skills it analyzed in the first week of February 2026 behaved maliciously. Solana-themed skills made up 9.3% of the malicious set and Phantom-wallet skills 8.2%. Some skills told users to run fake installers that dropped the AMOS macOS stealer. Solana skills that read SOLANA_KEYPAIR_PATH can expose the plain-text keypair file that holds a wallet's private key. Payloads were staged on 91.92.242[.]30 and an impersonated OpenClaw GitHub repo. Anyone who installed crypto skills and ran their setup commands should move funds to a new wallet.
Why this severity: Only partly contained, many people exposed.
AI involvement
AI agents as the target. Malicious skills for the OpenClaw AI agent posed as Solana, Phantom and other crypto tools; some delivered the AMOS stealer and Solana keys were exposed in plain-text keypair files.
Give agents a small, capped wallet with allow-listed destinations, and never let an agent that can sign read untrusted content.
- Started
- Feb 5, 2026
- Chains
- Solana, Multiple EVM chains
- Method
- Supply-chain stealers
Indicators · never visit or send to these
- 91.92.242[.]30
- github[.]com/Ddoy233/openclawcli
What to do now
- Move funds from any wallet whose keypair file or seed was on that machine to a new wallet created on a clean device.
- Remove the skills, then scan the machine. AMOS also steals browser passwords and cookies, so change important passwords from another device.
- Rotate API keys and tokens stored in environment variables on that machine.
Stay safe
Am I affected?
You may be affected if you installed OpenClaw skills for Solana, Phantom, trading or wallet tracking in early 2026. You are at higher risk if a skill told you to run a terminal command, download a 'tool' (for example AuthTool.exe) or install a macOS helper.
What to do now
- Move funds from any wallet whose keypair file or seed was on that machine to a new wallet created on a clean device.
- Remove the skills, then scan the machine. AMOS also steals browser passwords and cookies, so change important passwords from another device.
- Rotate API keys and tokens stored in environment variables on that machine.
How to avoid this
- Treat AI-agent skills like software installs. Read what a skill runs before installing it, and avoid any that download binaries or ask for install commands.
- Never keep a funded Solana keypair JSON file or seed in plain text where agents or tools can read it. Use a hardware wallet or a separate signer.
- Run crypto tooling in an isolated machine or container with only small balances.
Timeline 1
Bitdefender Labs published its analysis of malicious OpenClaw skills, including Solana- and Phantom-themed lures that delivered the AMOS stealer.
Source
News & write-ups ›1
How this method works
A popular code package or app update is hijacked to steal wallet keys or swap addresses, hitting everyone who installs it. Read about supply-chain stealers →
Follow new drains and updates in your feed reader or Telegram RSS bot.