230 Malicious OpenClaw Extensions Discovered on ClawHub, Posing as Crypto Trading Tools

Security researchers have uncovered a significant malware campaign involving 230 malicious browser extensions uploaded to ClawHub, a platform for OpenClaw extensions, since January 27, 2026. These extensions were disguised as cryptocurrency trading automation tools but were designed to steal user information.

The malicious extensions, which researchers have dubbed "OpenSourceMalware," were uploaded to ClawHub under the guise of legitimate crypto trading automation tools. The campaign highlights the growing sophistication of threat actors targeting cryptocurrency enthusiasts through seemingly helpful browser extensions.

According to the security researchers, the malicious extensions were designed to harvest sensitive user data, including login credentials, wallet addresses, and other personal information that could be exploited for financial gain. The extensions likely used various techniques to capture user input, monitor browsing activity, and potentially execute unauthorized transactions.

The discovery raises serious concerns about the security practices of extension marketplaces and the risks faced by cryptocurrency users who rely on third-party tools to automate their trading activities. The fact that 230 malicious extensions were able to be uploaded to ClawHub suggests potential vulnerabilities in the platform's vetting process.

This incident follows a broader trend of cybercriminals targeting the cryptocurrency ecosystem through various attack vectors, including phishing, malware, and social engineering. The use of browser extensions as a delivery mechanism for malware has become increasingly common, as these tools often require extensive permissions to function properly, giving them broad access to user data.

Security experts recommend that cryptocurrency users exercise extreme caution when installing browser extensions, particularly those related to financial activities. Users should verify the legitimacy of extensions through multiple sources, check developer reputations, and be wary of extensions that request excessive permissions.

The OpenSourceMalware campaign serves as a reminder of the ongoing security challenges in the cryptocurrency space and the need for robust security measures to protect users from increasingly sophisticated threats. As the cryptocurrency market continues to grow, so too does the incentive for malicious actors to develop and deploy targeted attacks against this lucrative target.

For users who may have installed any OpenClaw extensions from ClawHub during the specified timeframe, security researchers recommend immediate removal of the extensions and thorough security scans of their systems. Additionally, users should change passwords and enable two-factor authentication on any accounts that may have been compromised.

This discovery underscores the importance of maintaining vigilance in the cryptocurrency ecosystem and the need for continuous monitoring of third-party tools and platforms that handle sensitive financial information.