Over 575 malicious OpenClaw skills delivered malware to Windows and macOS

Acronis' TRU Cyber Pulse 2026 report describes how threat actors are now using AI agents themselves to run attacks, alongside stolen credentials and techniques aimed at disabling detection and recovery tools. In one tracked operation called BOSSAI, a single operator linked over 10 AI models to reconnaissance and exploitation tools, managing concurrent campaigns against targets in Taiwan, Thailand and Mexico via messaging apps like WeChat and LINE, with some tools set to execute automatically without human approval. Separately, researchers found more than 575 malicious OpenClaw skills disguised as useful utilities, which installed trojans, cryptominers and infostealers on Windows and macOS machines, echoing similar fake-model and fake-dataset malware found on Hugging Face. The report also covers the Red Heron campaign exploiting a Gitea vulnerability a day after patching, plus ransomware families like Qilin, LockBit 5.0 and INC, which specifically target backup shadow copies, EDR tools and virtualization snapshots to cripple recovery during an attack.