Threats

Infostealers Begin Targeting OpenClaw AI Agent Configuration Files, Stealing Gateway Tokens and Cryptographic Keys

Zero Day Wire

16 Feb 2026 — 2 min read

Information-stealing malware has been caught exfiltrating configuration files from OpenClaw, the rapidly growing open-source AI agent platform, in what researchers describe as the first observed case of infostealers targeting AI agent infrastructure.

"This finding marks a significant milestone in the evolution of infostealer behavior: the transition from stealing browser credentials to harvesting the 'souls' and identities of personal AI agents," Hudson Rock said.

What Was Stolen

The infection, attributed to a likely Vidar stealer variant, captured three critical OpenClaw files through a broad file-grabbing routine rather than a dedicated OpenClaw module:

openclaw.json — Contains the OpenClaw gateway authentication token, the victim's email address, and workspace path. A stolen gateway token could allow an attacker to connect to the victim's local OpenClaw instance remotely if the port is exposed, or masquerade as the client in authenticated requests to the AI gateway.

device.json — Contains cryptographic keys used for secure pairing and signing operations within the OpenClaw ecosystem.

soul.md — Contains the agent's core operational principles, behavioral guidelines, and ethical boundaries — effectively the AI agent's identity and instruction set.

Why This Matters

OpenClaw has surged to over 200,000 GitHub stars since its November 2025 debut and is increasingly integrated into professional development workflows. AI agents running on OpenClaw often have permissions to access email, APIs, cloud services, and internal resources. Compromising an agent's authentication tokens doesn't just steal credentials — it gives attackers a pre-authorised entry point into every service the agent can reach.

Hudson Rock warned that as AI agents become more embedded in workflows, infostealer developers will likely release dedicated parsing modules specifically designed to decrypt and extract OpenClaw data, mirroring how existing stealers already target Chrome, Telegram, and cryptocurrency wallets.

Broader OpenClaw Security Concerns

The infostealer finding arrives alongside a series of escalating security issues across the OpenClaw ecosystem:

SecurityScorecard's STRIKE team has identified hundreds of thousands of exposed OpenClaw instances vulnerable to remote code execution. An exposed instance with permissions to email, APIs, or cloud services becomes a pivot point requiring only one exploited service to compromise downstream resources.

The OpenSourceMalware team documented an ongoing campaign targeting ClawHub — OpenClaw's skill registry — using lookalike websites to host malware while uploading decoy skills to bypass VirusTotal scanning. The technique shifts from embedding payloads directly in skill files to external malware hosting, demonstrating threat actor adaptation to detection capabilities.

In response, OpenClaw's maintainers announced a partnership with VirusTotal to scan ClawHub skill uploads, established a formal threat model, and added auditing capabilities for misconfigurations.

Recommendation

Organisations deploying OpenClaw should treat agent configuration files with the same sensitivity as SSH keys and API credentials. Restrict file system permissions on openclaw.json and device.json, avoid exposing OpenClaw ports to the internet, and monitor for unauthorised access to agent configuration directories. Audit the permissions granted to AI agents — particularly access to email, cloud APIs, and internal resources — and apply the principle of least privilege. Review ClawHub skill installations against known malicious indicators and update to the latest OpenClaw version with VirusTotal scanning enabled.

PayPal Confirms Six-Month Data Exposure After Loan System Code Error Leaked Social Security Numbers

PayPal has confirmed a data exposure incident affecting its Working Capital (PPWC) business loan service, where a software code change left sensitive customer information accessible for nearly six months before being detected. The exposure ran from 1 July 2025 to 12 December 2025, when the error was finally discovered and

AWS Reports 600+ FortiGate Firewalls Compromised in AI-Augmented Campaign by Russian-Speaking Cybercrime Group

A financially motivated Russian-speaking cybercrime group compromised more than 600 internet-exposed FortiGate firewalls across 55 countries in just over a month, using off-the-shelf generative AI tools to scale an operation that would traditionally require a well-resourced team, according to a new incident report from AWS. The campaign, which ran from

ClickFix Campaign Compromises Legitimate Sites to Deploy MIMICRAT — A Custom C++ RAT With 22 Post-Exploitation Commands

Elastic Security Labs has disclosed a new ClickFix campaign that leverages compromised legitimate websites as delivery infrastructure to deploy a previously undocumented remote access trojan dubbed MIMICRAT (also tracked as AstarionRAT). The campaign, discovered earlier this month, demonstrates significant operational sophistication — from multi-stage PowerShell chains that bypass Windows security controls

ShinyHunters Linked to Device Code Vishing Attacks Targeting Microsoft Entra Accounts via OAuth 2.0 Abuse

A new wave of attacks is combining voice phishing (vishing) with OAuth 2.0 device authorization abuse to compromise Microsoft Entra accounts at technology, manufacturing, and financial organizations — bypassing traditional phishing infrastructure entirely. Sources told BleepingComputer they believe the ShinyHunters extortion gang is behind the campaigns, which the threat actors