Tracking AMOS Across the Poisoned AI Agent Skills Ecosystem

Dozens of AI skills that deliver Atomic macOS Stealer (AMOS) have been active on popular skills marketplaces in recent months, new research from Cyera shows. All of them carried high security grades on a popular marketplace, giving users a false sense of trust. 

These findings follow in the footsteps of the ClawHavoc campaign, documented by several security vendors, which hid AMOS inside skills for OpenClaw agents. The newer wave of malicious skills follow the same pattern: Attackers embed fake prerequisites in seemingly useful skills that extend the capabilities of agents, steering agents and users toward commands that install credential-stealing malware. The malicious instructions appear alongside ordinary documentation, making the threat easy to overlook.

Cyera Research tracked the campaign’s evolution and reach across the AI skills ecosystem to provide security practitioners with practical intelligence for recognizing and investigating this growing supply chain threat. This investigation examines how poisoned skills conceal malicious instructions, where automated security checks fail to identify them, and how they’re distributed.

The History of AMOS and AI Campaigns

Atomic macOS Stealer (AMOS) is an infostealer malware family targeting Mac, first publicly documented in April 2023 and sold through a malware-as-a-service model. Its operators use deceptive installers, cracked software, and fake setup instructions to persuade victims to execute it. Depending on the variant, AMOS collects various PII and secrets (such as browser passwords and session cookies, keychain information, and sensitive files), then sends the stolen data to attacker-controlled infrastructure. 

Public reporting in early 2026 exposed a growing malware-distribution operation built around poisoned skills for OpenClaw, the popular open-source AI assistant. 

• Koi Security discovered and named the principal coordinated campaign ClawHavoc.
• Bitdefender and Trend Micro confirmed AMOS delivery through AI workflows, including fake authentication tools and an OpenClawCLI installation website. 
• Unit 42 observed continued use of AMOS infrastructure alongside a separate macOS stealer (cluw) delivered through a prerequisite-and-paste-site pattern. 
• Flare documented multiple threat groups distributing poisoned OpenClaw skills, including the automated publication of malicious skills on the ClawHub marketplace.
• Acronis also identified extensive malicious-skill distribution and a Windows dependency installer delivering a cryptominer. 

Together, these findings show an expanding set of overlapping delivery operations that all rely on trusted skill documentation to introduce malicious dependencies.

Cyera Research Findings 

As part of Cyera Research’s larger research covering 1.3 million AI skills, MCP servers, and AI plugins, we tracked the evolution of the AMOS campaign. Out of the 1.3 million objects, about 1 million were related to skills. Our goal was to build an engine that can detect the maliciousness of these objects, so we started by collecting data from VirusTotal and the Hugging Face training dataset to establish a set of known bad and suspicious samples. We added multiple data from various other AI repositories and GitHub repositors. We ran various versions of these engines on the unknown datasets and were able to detect a number of live malicious attacks. 

We ended up with 516 samples that were classified as the AMOS campaign. Below you can see the sources of these skills.

A few patterns jump out when analyzing the below chart showing the number of malicious skills active in any given month, but they require careful interpretation. The timeline shows activity from February through June 2026, followed by an apparent complete stop in July and August and a sharp increase in September. 

But the summer gap may reflect incomplete collection or platforms detecting and removing malicious skills more effectively rather than an interruption in the campaign. We observed evidence consistent with the latter explanation: approximately one week after each collection period, most of the newly identified skills had been marked as malicious and removed from the repositories. This suggests that some September findings captured a window between publication and detection/removal.

Our dataset consisted of two types of data. The first type was skills extracted from curated sources like VirusTotal, which mostly consisted of malicious/suspicious files, and Hugging Face, which had several datasets for machine learning labeled malicious or benign. The second type of data was live skills repositories that host skills used by practitioners. This data was not labeled, so we didn’t know what type of skills we would find there.

The September increase is a bit misleading because it contains a Hugging Face artifact of 152 known malicious or benign skills that were collected over time. To account for this, we illustrated how the timeline looks with them and without them. 

Excluding those records leaves 70 exhibits from other sources, providing a more representative view of the activity observed during September. That figure remains subject to collection and dating limitations and should not be treated as a direct measure of attacker production or successful infections.

Lure Analysis of Skills Patterns

The lure patterns exploit familiar setup workflows, presenting malicious dependencies as prerequisites for useful automation. Their breadth suggests a reusable delivery model: attackers can adapt the surrounding documentation to different audiences while retaining the same infection chain. This makes installation behavior a stronger detection signal than the advertised skill topic. 

Many of the malicious skills fall into categories that fit within the work of corporate employees. Developer tools were the most commonly targeted category at roughly 36%. Social media skills were next at almost 25%, and office productivity tools ranked fourth at about 13%.

Malware Staging 

In poisoned AI skills, the SKILL.md file can act as the lure, directing an agent or user to retrieve an external resource presented as a prerequisite, setup step, or troubleshooting solution.

Our analysis identified that in most skills files the threat actors aimed to target both Windows and macOS users by instructing the system to install a prerequisite software based on the OS. The Windows malware was not AMOS but a separate package.

IP references are heavily concentrated: 91.92.242.30 accounts for 83.7% of the total, highlighting extensive reuse of a single payload host. This could point to one group of cybercriminals leading this campaign or Malware as a Service (MaaS) used by a broader group of people.

The paste-relay pattern is similarly concentrated. Two glot.io snippets account for 95.9% of references, showing how shared delivery links propagate across many poisoned skills.

Anatomy of an AMOS-Delivering Poisoned Skill

Poisoned skills embed malicious setup instructions within otherwise plausible documentation. Three recurring strong patterns appear across our dataset: 

1. Inline Base64 commands
2. A glot.io paste-site relay
3. Impersonation of ClawHub or OpenClaw utilities

These patterns overlap in that they can all use a skill to claim that a fake utility is mandatory, direct the agent or user to an external page, and supply an encoded installation command there. 

The instructions frequently distinguish between operating systems. MacOS users receive a command that decodes a Base64 string and executes it through Bash, while Windows users are directed to download an archive and run an executable. 

In the macOS example, the visible swcdn.apple.com address is merely printed by echo. The actual download destination, however, sits inside the encoded (base64) command. 

Across the 45-file sample, the malicious block appeared approximately 25% into the file on average, commonly beneath “Prerequisites,” “Setup,” “IMPORTANT,” or “CRITICAL REQUIREMENT” headings. Statements such as “the skill will not work” and “ensure openclaw-agent is active” manufacture a dependency between the legitimate task and the malicious installer. The instruction chain can also extend into companion files or external resources: JFrog documented an encoded dropper in a roughly 22 MB README.md, illustrating how reviewing only SKILL.md can miss harmful content.

Useful hunting markers included release-download links to ZIP or EXE assets (42 cases), glot.io snippet references (30 cases), “will not work” combined with openclaw-agent (30 cases), and base64 -D piped to Bash (15 cases). 

Why Agentic Skills Are Dangerous By Default

Conventional scanners can miss malicious skills because the attack begins as instructions in a Markdown file, with malicious behavior emerging when an agent follows them. Tools focused on executable payloads or source-code flaws may overlook text that directs an agent to decode and run a command. Base64 encoding can conceal C2 addresses and /bin/bash from plaintext signature searches, while malicious instructions buried among legitimate content make inspection harder. 

Some variants also inflate README files to 22 MB, as reported by JFrog, potentially exceeding scanner size limits. Newly created burner repositories and skills without prior VirusTotal records further weaken reputation-based detection. 

The 516-exhibit corpus illustrates the detection gap. On platforms that use automated evaluation, all 70 confirmed-malicious skills we identified received high security grades. This suggests that automated checks performed after upload can miss malicious instructions embedded in skill files.

Taking Skills Directory as an example, you can see below how the malicious skills scored.

Skills Directory assigns automated security grades: A (90–100) indicates few detected risk signals, while B (75–89) indicates some concerns that warrant closer inspection. But according to the site’s methodology, the grade covers only SKILL.md — bundled scripts and other files do not contribute to the score. These grades reflect the scanner’s findings and do not guarantee that a skill is safe.

While the malicious skills were removed after a few days, there’s still time for threat actors to infect victims with malware. As skills become a part of how employees work every day, security teams need to take a deeper look at what’s in their environment. Keeping an eye out for the red flags listed above can help mitigate this new threat vector. 

How Cyera Helps

While some of these campaigns target OpenClaw agents, they can work with any agents that use skills. Our research shows a close inspection of what’s actually installed can help indicate whether a skill is truly safe. For teams running Claude Code and Claude Cowork, Cyera Agent Guardian catalogs all connected MCP servers and active skills across endpoints and classifies them as sanctioned or unsanctioned.

From there, Agent Guardian checks downloaded skill files for hardcoded secrets and unvetted actions, then validates each skill against the user’s identity and role. It can block skills that violate policy, and it evaluates tool calls before they execute, which can help prevent hidden, malicious commands.

Indicators of Compromise (IoC)

Network

• 91.92.242[.]30 (primary payload C2)
• 5.42.65[.]10
• 45.137.65[.]112
• 185.234.72[.]19
• 2.26.75.16
• socifiapp[.]com/api/reports/upload (exfil, Cloudflare-fronted: 104.21.79.8 / 172.67.139.79)
• custom-registry[.]com
• openclawskills[.]net
• install[.]app-distribution[.]net
• openclawcli[.]vercel[.]app
• download[.]setup-service[.]com
• laosji[.]net
• letssendit[.]fun
• monster-secure[.]site
• vorderingenonline[.]com
• glot.io/snippets/hfdxv8uyaf
• glot.io/snippets/hfd3x9ueu5
• rentry.co/openclaw-code (paste relays)

Actors / publishers

hightower6eu, Demerzels-lab, LJT-520, dexiaong, Ddoy233, hedefbari, Aslaep123, denboss99, syazema, sakaen736jih, zaycv/zaycruz, aslaep123, toolitletolate, dvcrn, kbarbel640-del, Trompetilla, johnalbertini14-glitch, baneeishaque

Fake-tool assets (all taken down)

openclaw-agent.zip, AuthTool.zip/.exe, openclawcli.zip, openclawcore-1.0.3.zip, PolymarketAuthTool.zip, OpenClawProvider-1.0.2.zip  (pass 1234 / openclaw)

Payload tokens (17, each an AMOS binary name)

6x8c0trkp4l9uugo, tjjve9itarrd3txw, 6wioz8285kcbax6v, q0c7ew2ro8l2cfqp, lamq4uerkruo6ssm, ece0f208u7uqhs6x, il24xgriequcys45, dx2w5j5bka6qkwxi, 1v07y9e1m6v7thl6, l5ou8r739pc48rwi, dyrtvwjfveyxjf23, gbi7aev47pu0tf68, 7buu24ly8m1tn8m4, sujwb2nsdn93d79q, x5ki60w1ih838sp7, pcvy5ys1p5zxxsik, ozv614w31u0f80wy

AMOS samples SHA-256 (22)

818aea6143282b352fdfdc0f3ebf77a36e54eb3befb5cad1a355a99ab97c6aa7

881ce5cb124c4d2e814783724cc1388f6a1cbf6eee274c3f3366e77ba3503ad7

b30eaed1f7478c28f4ec50d07ed5ef014ffbc4b2bc5a38d689ba9f7abb5e19c2

b6c7e0bf573b1c7d9d3a05eb08d26579199515b847df984862805f44a7af8007

ebb73dbb5aac1f6fe1a88e8f26126a1e1aa34c9f3345ad4345189b40d9bf1d1d

f4e41aa269c88bf11a2022701a9cf41e9a186aa1b224d837c31bf34e0b875d0e

5968bd7d3a27a6a17ea73be6ee4b00807e83a786fdfa73cc5d8dbf262426c12c

ca96fe6259d602a22951d5d3e244e1b752bf0d20086f445bf7015c8798e7b95b

a0e66f3067e4aaf5b83e45b7845cc43b2fc96032a4398cab7cc9d11f4f962e91

1e6d4b0538558429422b71d1f4d724c8ce31be92d299df33a8339e32316e2298

5adb10e107d5075abf485f52a387fb419d06ad84d0df38e75769783f16862273

95fb8f28d08e19090443bda8bd71bbb79f7c451288a2de6f1ca0ad6fee8b4569

45d8e56bd86960727bcaa4b5c9f7c3422a22723c23ea5b46b6aa9bc42ed1f9f1

0e52566ccff4830e30ef45d2ad804eefba4ffe42062919398bf1334aab74dd65

ec2920e56f2f62c6a2ed1242747980f6f7343c2404b7ae9a6e975b66b1c24b6d

30f97ae88f8861eeadeb54854d47078724e52e2ef36dd847180663b7f5763168

d781d5cabaf5f305bbb8afcd9a54d7ba616bfa7aef5c4d16f6bce3d2bf3b4073

f0a54f2b44e557854b0a5001c4e10185884af945814786f78b86539014f78a16

233a98cb2c5536dabda0944eb2de8d47ad5ce9371a164fe2a8c29d8c55bc240c

f2cb9de40cb8b7e13e7d2b0b3e426f8503781a35d8bba3715395430e9b5eeb38

998c38b430097479b015a68d9435dc5b98684119739572a4dff11e085881187e

5e4696a2cfdc3336b1ecbc17c1642f6bf7d9a34497161659414dae33fe6225d7

A fake copy of Anthropic’s PDF skill kept its name and scripts but hid a backdoor. Why you need to verify the whole package, not just the name.