What happened
Security researchers at VirusTotal have identified malicious use of OpenClaw AI agent skills to facilitate credential stuffing and user profile hijacking attacks. According to the report, threat actors have been crafting and distributing custom OpenClaw agent skills—modular action routines within the AI assistant—that automate misuse of credentials and account takeover workflows. These malicious skills ingested stolen usernames and passwords and performed high-velocity authentication attempts against online services, succeeding at validating sets of breached login pairs. Once valid credentials were identified, the same agents were observed engaging in session-validation routines that enabled attackers to hijack user profiles without additional MFA challenges. The abuse of OpenClaw’s distributed skill system allowed the malicious logic to scale via numerous publicly exposed instances, amplifying the rate of attacks on targeted service endpoints. The activity leveraged the rapid proliferation and networked nature of OpenClaw deployments to distribute and execute the harmful skills across many instances.
Who is affected
Owners of accounts targeted by credential stuffing driven through malicious OpenClaw skills are directly affected, as successful validation and session hijacking can lead to unauthorized access to user profiles and connected services.
Why CISOs should care
The incident illustrates how extensible AI agent ecosystems like OpenClaw can be abused at scale to orchestrate credential abuse and automate profile takeovers, increasing risk to identity security and service integrity in environments where such agents are widely deployed.
3 practical actions
- Monitor for unauthorized AI agent behavior. Review logs for high-volume credential validation patterns that may indicate OpenClaw-driven attacks.
- Identify and disable malicious skills. Audit and remove unauthorized skills from OpenClaw instances to stop abuse.
- Rate-limit authentication endpoints. Apply throttling and anomaly detection on login services to mitigate high-velocity credential stuffing.