Cybersecurity News reports that multiple threat campaigns are targeting exposed OpenClaw deployments, citing claims of remote-code-execution abuse, poisoned community packages, and credential theft via unsecured admin interfaces. The report, referencing Flare analysis, says attackers have used malicious setup scripts and backdoored skills to extract API keys, OAuth tokens, and passwords, and to deploy information-stealing malware. It also cites a Shodan snapshot showing more than 312,000 internet-exposed instances on the default port, with many lacking authentication, and recommends isolating workloads and tightening credential controls.

Multiple Hacking Groups Exploit OpenClaw Instances to Steal API key and Deploy Malware - Cyber Security News