Infostealer malware targets OpenClaw AI agents, stealing API keys and authentication tokens

Infostealer Malware Steals OpenClaw Configuration Files in First Documented Attack

Hudson Rock has documented the first in-the-wild instance of infostealer malware successfully exfiltrating a victim's OpenClaw configuration environment, marking a critical evolution in how threat actors target users 1

1

. The cybersecurity company detected a live infection where an infostealer captured files containing API keys, authentication tokens, and other secrets used by the AI agents to access cloud-based services and AI platforms. This finding represents a significant milestone in infostealer behavior: the transition from stealing browser credentials to harvesting the digital identity of personal AI agents 2

2

.

Alon Gal, co-founder and CTO of Hudson Rock, identified the malware as likely a variant of the Vidar infostealer, with the data stolen on February 13, 2026 1

1

. OpenClaw, formerly known as ClawdBot and MoltBot, is a local-running AI agent framework that maintains a persistent configuration and memory environment on the user's machine, with the ability to access local files, log in to email and communication apps, and interact with online services.

How the Attack Targeted AI Agent Configuration Files

The infostealer does not appear to target OpenClaw specifically but instead executes a broad file-stealing routine that scans for sensitive files and directories containing keywords like "token" and "private key" 1

1

. Because files in the ".openclaw" configuration directory contained these keywords, they were captured by the malware. The data capture was not facilitated by a custom OpenClaw module within the stealer malware, but rather through a broad file-grabbing routine designed to look for certain file extensions and specific directory names containing sensitive data 2

2

.

Hudson Rock's AI analysis tool concluded that the stolen data is enough to potentially enable a full compromise of the victim's digital identity 1

1

. The theft of gateway tokens can allow an attacker to connect to the victim's local OpenClaw instance remotely if the port is exposed, or even masquerade as the client in authenticated requests to the AI gateway 2

2

.

Shift in Cybercrime Targets as AI Agents Enter Professional Workflows

Hudson Rock had predicted this development since late last month, calling OpenClaw "the new primary target for infostealers" due to the highly sensitive data the agents handle and their relatively lax security posture . The researchers expect information stealers to continue focusing on stealing OpenClaw secrets as the tool becomes increasingly integrated into professional workflows. As AI agents like OpenClaw become more integrated into workflows, infostealer developers will likely release dedicated modules specifically designed to decrypt and parse these files, much like they do for Chrome or Telegram today 3

3

.

This evolving threat represents a fundamental change in how cybersecurity professionals must think about protecting users. While the malware may have been looking for standard secrets, it inadvertently struck gold by capturing the entire operational context of the user's AI assistant 2

2

.

Additional Security Concerns for OpenClaw Users

The security issues extend beyond infostealer malware. Tenable discovered a max-severity flaw in nanobot, an ultra-lightweight personal AI assistant inspired by OpenClaw, that could potentially allow remote attackers to hijack WhatsApp sessions via exposed instances fully. Nanobot, released two weeks ago, already has 20k stars and over 3k forks on GitHub. The team released fixes for the flaw, tracked under CVE-2026-2577, in version 0.13.post7 1

1

.

SecurityScorecard's STRIKE Threat Intelligence team found hundreds of thousands of exposed OpenClaw instances, likely exposing users to Remote Code Execution risks. When OpenClaw runs with permissions to email, APIs, cloud services, or internal resources, an RCE vulnerability can become a pivot point 2

2

. Security issues with OpenClaw prompted the maintainers to announce a partnership with VirusTotal to scan for malicious skills uploaded to ClawHub, establish a threat model, and add the ability to audit for potential misconfigurations 2

2

.

OpenClaw has had a viral surge in interest since it first debuted in November 2025. As of writing, the open-source project has more than 200,000 stars on GitHub. On February 15, 2026, OpenAI CEO Sam Altman announced that OpenClaw's founder, Peter Steinberger, would be joining the AI company, adding that OpenClaw will live in a foundation as an open source project that OpenAI will continue to support 2

2

.