ClawHavoc campaign
Named by 4 kept items in this workspace.
Search every workspace for ClawHavoc campaign. It matches the name as written, so it can find other things that share it.
The items that name it 4
Pushed 1,184 malicious skills through 12 accounts to the ClawHub registry; at peak infection five of the seven most downloaded skills on the registry were malware; carried trusted brand names (e.g. 'Google', 'Solana Wallet Tracker', 'Polymarket Trader') without authorization (AST04); exploited lack
2026 coordinated publication of malicious skills to a public marketplace, delivering a credential stealer
Attackers registered as ClawHub developers and flooded the registry with 341 malicious skills in a 3-day window (Jan 27-29, 2026); final tally 1,184 malicious skills across 12 publisher accounts targeting exchange API keys, wallet private keys, SSH credentials, browser passwords, and .env files; als
Attackers registered as ClawHub developers and flooded the registry with 341 malicious skills in a 3-day window (Jan 27-29, 2026); final tally 1,184 malicious skills across 12 publisher accounts (Antiy CERT). All 335 AMOS-delivering skills shared a single C2 IP (91.92.242[.]30). Targeted exchange AP
All threat actors in this workspace.