{
 "slug": "openclaw-clawhub-malicious-skills-solana-phantom-feb-2026",
 "title": "Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys",
 "url": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026",
 "json": "https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026.json",
 "status": "live",
 "severity": "high",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "ai": {
  "role": "agent-target",
  "note": "Malicious skills for the OpenClaw AI agent posed as Solana, Phantom and other crypto tools; some delivered the AMOS stealer and Solana keys were exposed in plain-text keypair files."
 },
 "chains": [
  "solana",
  "multi-evm"
 ],
 "method": "supply-chain",
 "product": "OpenClaw (ClawHub) skill users",
 "tags": [
  "solana",
  "multi-evm",
  "supply-chain",
  "openclaw",
  "clawhub",
  "ai-agent",
  "skills",
  "amos-stealer",
  "macos",
  "infostealer",
  "phantom",
  "ai"
 ],
 "amountUsd": null,
 "victims": null,
 "startedAt": "2026-02-05",
 "closedAt": null,
 "updatedAt": "2026-10-22T21:53:35.016Z",
 "summary": "Bitdefender found that about 17% of the OpenClaw (ClawHub) AI-agent skills it analyzed in the first week of February 2026 behaved maliciously. Solana-themed skills made up 9.3% of the malicious set and Phantom-wallet skills 8.2%. Some skills told users to run fake installers that dropped the AMOS macOS stealer. Solana skills that read SOLANA_KEYPAIR_PATH can expose the plain-text keypair file that holds a wallet's private key. Payloads were staged on 91.92.242[.]30 and an impersonated OpenClaw GitHub repo. Anyone who installed crypto skills and ran their setup commands should move funds to a new wallet.",
 "timeline": [
  {
   "date": "2026-02-05",
   "title": "Bitdefender Labs published its analysis of malicious OpenClaw skills, including Solana- and Phantom-themed lures that delivered the AMOS stealer.",
   "sourceUrl": "https://www.bitdefender.com/en-au/blog/labs/helpful-skills-or-hidden-payloads-bitdefender-labs-dives-deep-into-the-openclaw-malicious-skill-trap"
  }
 ],
 "sources": [
  {
   "kind": "writeup",
   "title": "Helpful Skills or Hidden Payloads? Bitdefender Labs Dives Deep into the OpenClaw Malicious Skill Trap",
   "url": "https://www.bitdefender.com/en-au/blog/labs/helpful-skills-or-hidden-payloads-bitdefender-labs-dives-deep-into-the-openclaw-malicious-skill-trap",
   "publisher": "Bitdefender",
   "date": "2026-02-05"
  }
 ],
 "indicators": {
  "domains": [
   "91.92.242[.]30",
   "github[.]com/Ddoy233/openclawcli"
  ],
  "addresses": []
 },
 "brief": "## Am I affected?\nYou may be affected if you installed OpenClaw skills for Solana, Phantom, trading or wallet tracking in early 2026. You are at higher risk if a skill told you to run a terminal command, download a 'tool' (for example AuthTool.exe) or install a macOS helper.\n\n## What to do now\n- Move funds from any wallet whose keypair file or seed was on that machine to a new wallet created on a clean device.\n- Remove the skills, then scan the machine. AMOS also steals browser passwords and cookies, so change important passwords from another device.\n- Rotate API keys and tokens stored in environment variables on that machine.\n\n## How to avoid this\n- Treat AI-agent skills like software installs. Read what a skill runs before installing it, and avoid any that download binaries or ask for install commands.\n- Never keep a funded Solana keypair JSON file or seed in plain text where agents or tools can read it. Use a hardware wallet or a separate signer.\n- Run crypto tooling in an isolated machine or container with only small balances.",
 "notes": null,
 "agentBrief": "# Malicious OpenClaw AI-agent skills pose as Solana and Phantom tools to steal wallet keys\n\n- Severity: High · Status: Partly contained (live)\n- Chains: Solana, Multiple EVM chains · Method: Supply-chain stealers\n- Started: Feb 5, 2026 · Last update: Oct 22, 2026\n- Who/what: OpenClaw (ClawHub) skill users\n- AI involvement: AI agents as the target. Malicious skills for the OpenClaw AI agent posed as Solana, Phantom and other crypto tools; some delivered the AMOS stealer and Solana keys were exposed in plain-text keypair files.\n\nBitdefender found that about 17% of the OpenClaw (ClawHub) AI-agent skills it analyzed in the first week of February 2026 behaved maliciously. Solana-themed skills made up 9.3% of the malicious set and Phantom-wallet skills 8.2%. Some skills told users to run fake installers that dropped the AMOS macOS stealer. Solana skills that read SOLANA_KEYPAIR_PATH can expose the plain-text keypair file that holds a wallet's private key. Payloads were staged on 91.92.242[.]30 and an impersonated OpenClaw GitHub repo. Anyone who installed crypto skills and ran their setup commands should move funds to a new wallet.\n\n## Am I affected?\nYou may be affected if you installed OpenClaw skills for Solana, Phantom, trading or wallet tracking in early 2026. You are at higher risk if a skill told you to run a terminal command, download a 'tool' (for example AuthTool.exe) or install a macOS helper.\n\n## What to do now\n- Move funds from any wallet whose keypair file or seed was on that machine to a new wallet created on a clean device.\n- Remove the skills, then scan the machine. AMOS also steals browser passwords and cookies, so change important passwords from another device.\n- Rotate API keys and tokens stored in environment variables on that machine.\n\n## How to avoid this\n- Treat AI-agent skills like software installs. Read what a skill runs before installing it, and avoid any that download binaries or ask for install commands.\n- Never keep a funded Solana keypair JSON file or seed in plain text where agents or tools can read it. Use a hardware wallet or a separate signer.\n- Run crypto tooling in an isolated machine or container with only small balances.\n\n## Indicators (block these, never visit them)\n- Domain: 91.92.242[.]30\n- Domain: github[.]com/Ddoy233/openclawcli\n\n## Sources\n- Helpful Skills or Hidden Payloads? Bitdefender Labs Dives Deep into the OpenClaw Malicious Skill Trap (Bitdefender, 2026-02-05): https://www.bitdefender.com/en-au/blog/labs/helpful-skills-or-hidden-payloads-bitdefender-labs-dives-deep-into-the-openclaw-malicious-skill-trap\n\nFull record: https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026 · JSON: https://drains.watch/i/openclaw-clawhub-malicious-skills-solana-phantom-feb-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}