THREAT OPS › Threat News › From Automation to Infection (Part II): Reverse Shells, Semantic Worms, and Cognitive Rootkits in OpenClaw Skills
From Automation to Infection (Part II): Reverse Shells, Semantic Worms, and Cognitive Rootkits in OpenClaw Skills
<p><a href="https://blog.virustotal.com/2026/02/from-automation-to-infection-how.html">In part one</a>, we showed how OpenClaw skills are rapidly becoming a supply-chain delivery channel: third-party "automation" that runs with real system access. This second installment expands the taxonomy with five techniques VirusTotal is actively seeing abused through skills, spanning remote execution, propag
MITRE ATT&CK techniques
- Social EngineeringT1684
- CredentialsT1589.001
- System PromptAML.T0069.002
- Reverse ShellAML.T0072
Indicators of compromise
- b6337869e41e89f4c20a20c3f2b7c7a2ed7118edc33201484c40c4c66f16ebccsha256
- 59381ac34214655f3d80dcf95a49e2ac1fdf40ccde5cab96c2e87787ef95734dsha256
- 053881c6229706ae06891f35617bceea7aa0cbe29394721de640fbc2711de138sha256
- b604ef3dc9bbdc45c768560ee4e092de21740e14f955c3731df1041c65b9bec3sha256
- 7cfd55f71ac53c2cdfc83204ca4d8b4ae4c9f2f77f8a1ab6c18b4015f1e5e34fsha256
- https://www.virustotal.com/gui/file/b6337869e41e89f4c20a20c3f2b7c7a2ed7118edc33201484c40c4c66f16ebccurl
- https://www.virustotal.com/gui/file/59381ac34214655f3d80dcf95a49e2ac1fdf40ccde5cab96c2e87787ef95734durl
- https://www.virustotal.com/gui/file/053881c6229706ae06891f35617bceea7aa0cbe29394721de640fbc2711de138url
- https://www.virustotal.com/gui/file/b604ef3dc9bbdc45c768560ee4e092de21740e14f955c3731df1041c65b9bec3url
- https://www.virustotal.com/gui/file/7cfd55f71ac53c2cdfc83204ca4d8b4ae4c9f2f77f8a1ab6c18b4015f1e5e34furl
- 54.91.154.110ipv4
- blogger.googleusercontent.comdomain
- mydeadinternet.comdomain
- webhook.sitedomain