One Actor, 677 Malicious Skills: The AMOS Stealer ClawHub Campaign

A single threat actor published 677 malicious skills on ClawHub in 3 days, distributing Atomic macOS Stealer (AMOS) to 7,000+ victims. All skills shared one C2 server. Here's the full teardown.

Campaign Overview

The Kill Chain: From SKILL.md to Full Compromise

Every single one of the 677 skills followed the exact same playbook:

This is ClickFix 2.0 — social engineering that uses the AI agent as a trusted intermediary:

1. User installs skill — it looks professional, has a proper README, covers a legitimate use case (crypto analytics, social media, coding)
2. Agent reads SKILL.md — finds "Prerequisites" section, interprets it as legitimate setup requirements
3. Agent presents setup to user — "This skill requires a runtime component. Run this command to install it."
4. User trusts the agent — copies the curl command into Terminal
5. glot.io script executes — decodes Base64 payload, fetches second-stage dropper
6. AMOS binary drops — strips Gatekeeper quarantine, executes as Mach-O universal binary
7. Data exfiltration — passwords, cookies, crypto wallets, SSH keys sent to 91.92.242.30

The Payload: AMOS Stealer

Atomic macOS Stealer (AMOS) is a commercial infostealer sold on cybercrime forums for $500–$1,000/month. The variant delivered through ClawHavoc was a 521KB universal Mach-O binary (x86_64 + arm64).

What AMOS Steals

All strings in the binary are encrypted with a multi-key XOR scheme. After exfiltration, AMOS can also install backdoored versions of Ledger Live and Trezor Suite for persistent wallet monitoring.

Scale: 25 Categories, One Template

The attacker mass-generated skills across every ClawHub category to maximize reach:

111 skills were crypto-related alone: 33 Solana wallets, 28 Phantom utilities, 22 insider wallet finders, 24 wallet trackers.

IOC Table

Detection with ClawSafety

ClawSafety would flag these skills at multiple levels:

• CS-INJ-004: curl | bash pattern — every single skill contained this
• CS-DEP-001: Unsafe installation via piped shell commands
• CS-CFG-004: SKILL.md containing executable instructions that override agent behavior
• AI Analysis: 677 skills with identical prerequisite blocks, different descriptions — mass-generated template detection
• Network IOC: Hardcoded IP 91.92.242.30 — bare IP in a skill is a near-certain indicator of compromise

Key Takeaway

This wasn't a sophisticated zero-day exploit. It was low-tech social engineering at scale, exploiting two things:

1. ClawHub had no security review process for published skills
2. Users trusted the AI agent to present legitimate setup instructions

The entire campaign lasted 3 days. 677 skills. 7,000 downloads. One C2 server. All preventable with automated scanning.