Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Cato CTRL™ Threat Research: When OpenClaw, Your AI Personal Assistant, Becomes the Backdoor
Excerpt
TL;DR A threat actor is selling root shell access to a CEO’s computer at a UK-based automation company for $25K in crypto. The listing’s real value isn’t the shell. It’s the CEO’s OpenClaw AI personal assistant, which contains personal conversations, company databases, Telegram bot tokens, and Trading 212 API keys. With 45,000+ internet-facing OpenClaw instances (per Shodan) and 824 malicious skills discovered on ClawHub (per Koi ), AI personal…
Read the original report →Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-25253 | Medium | Score 59/100 | First seen |
| CVE | CVE-2026-25157 | Medium | Score 51/100 | First seen |
| CVE | CVE-2026-24763 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…