Trend Micro Research has uncovered a campaign in which threat actors are using malicious OpenClaw skills to distribute a new variant of the Atomic macOS Stealer (AMOS) — marking a critical evolution in supply chain attacks where AI agents themselves are weaponized as trusted intermediaries to socially engineer human users into infection.
AI Agents as Social Engineering Vectors
The campaign represents a fundamental shift from traditional malware delivery. Rather than targeting users directly, attackers upload malicious skills to ClawHub — OpenClaw's public skills marketplace — that contain hidden instructions in SKILL.md files. When an OpenClaw agent loads these skills, the embedded instructions manipulate the AI into presenting fake setup requirements to the user, including a deceptive human-in-the-loop dialog box that tricks users into manually entering their system password to facilitate infection.
Trend Micro researchers identified 39 distinct malicious skills that manipulate OpenClaw into installing a fake CLI tool, with no specific category pattern — the skills span productivity, crypto trading, development utilities, and entertainment. While these have been removed from ClawHub, the code persists in ClawHub's GitHub repository. Across a broader analysis, Trend Micro identified over 2,200 malicious skills on GitHub, making manual review by defenders impractical.
AMOS: Evolving Distribution Vectors
The AMOS variant delivered through this campaign lacks system persistence and ignores .env files but significantly expands its exfiltration scope, stealing Apple Keychain data, KeePass keychains, and various user documents. This follows a documented progression: AMOS was initially distributed through cracked macOS software, later spread through poisoned Generative Engine Optimization (GEO) answers — including poisoned responses from ChatGPT and Grok, as reported by Huntress — and now leverages malicious AI agent skills.
The Broader AI Agent Supply Chain Crisis
This campaign arrives amid an accelerating OpenClaw security crisis. SecurityWeek reports that despite rapid patching of CVE-2026-25253 and related vulnerabilities, a massive number of older, unpatched versions remain in use. SecurityScorecard found 40,214 exposed OpenClaw instances associated with 28,663 unique IP addresses, with 63% of observed deployments vulnerable and 12,812 exploitable via remote code execution.
Organizations should block OpenClaw skill installation from untrusted sources, deploy endpoint protection with real-time behavioral detection on all systems running AI agents, and treat AI agent skill registries with the same supply chain scrutiny applied to package managers like npm and PyPI.