Malicious OpenClaw Skill Distributes Remcos RAT and GhostLoader

Reported 05 May 2026 by otx · Severity: medium

In March 2026, threat actors weaponized the OpenClaw AI agent framework by publishing a deceptive "DeepSeek-Claw" skill. This skill embedded malicious installation instructions designed to trick AI agents and developers into executing hidden payloads. On Windows systems, a PowerS