More than 575 malicious OpenClaw skills deliver malware to Windows and macOS

The Acronis TRU Cyber Pulse 2026 report documents attackers using AI agents to coordinate cyberattacks, and notes that more than 575 malicious OpenClaw skills disguised as utilities delivered trojans, cryptocurrency miners and infostealers to Windows and macOS systems. In an investigation named BOSSAI, an operator connected more than 10 AI models to reconnaissance, scanning and exploitation tools, assigning tasks and monitoring agent activity via WeChat and LINE. The report says these skills can combine instructions with executable code and run using permissions the agent has already been granted; malicious payloads disguised as models, datasets and AI applications also exist on Hugging Face. The report also notes that stolen browser sessions can bypass new MFA verification to access associated cloud applications.