{"id":214302,"date":"2026-02-16T13:43:00","date_gmt":"2026-02-16T18:43:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/02\/16\/infostealer-steals-openclaw-ai-agent-configuration-files-and-gateway-tokens\/"},"modified":"2026-02-16T22:45:08","modified_gmt":"2026-02-17T03:45:08","slug":"infostealer-steals-openclaw-ai-agent-configuration-files-and-gateway-tokens","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/02\/16\/infostealer-steals-openclaw-ai-agent-configuration-files-and-gateway-tokens\/","title":{"rendered":"Infostealer Steals OpenClaw AI Agent Configuration Files and Gateway Tokens"},"content":{"rendered":"<p><a href=\"https:\/\/thehackernews.com\/2026\/02\/infostealer-steals-openclaw-ai-agent.html\">Infostealer Steals OpenClaw AI Agent Configuration Files and Gateway Tokens<\/a><\/p>\n<p><a href=\"https:\/\/thehackernews.com\/2026\/02\/infostealer-steals-openclaw-ai-agent.html\">https:\/\/thehackernews.com\/2026\/02\/infostealer-steals-openclaw-ai-agent.html<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-02-16 13:43:00<\/a><\/p>\n<p>Source Domain: <a href=\"thehackernews.com\">thehackernews.com<\/a><\/p>\n<p><span class=\"p-author\">\ue804<span class=\"author\">Ravie Lakshmanan<\/span>\ue802<span class=\"author\">Feb 16, 2026<\/span><\/span><span class=\"p-tags\">Artificial Intelligence \/ Threat Intelligence<\/span><\/p>\n<p>Cybersecurity researchers disclosed they have detected a case of an information stealer infection successfully exfiltrating a victim&#8217;s OpenClaw (formerly Clawdbot and Moltbot) configuration environment.<\/p>\n<p>&#8220;This finding marks a significant milestone in the evolution of infostealer behavior: the transition from stealing browser credentials to harvesting the &#8216;souls&#8217; and identities of personal AI [artificial intelligence] agents,&#8221; Hudson Rock said.<\/p>\n<p>Alon Gal, CTO of Hudson Rock, told The Hacker News that the stealer was likely a variant of Vidar based on the infection details. Vidar is an off-the-shelf information stealer that&#8217;s known to be active since late 2018.<\/p>\n<p>That said, the cybersecurity company said the data capture was not facilitated by a custom OpenClaw module within the stealer malware, but rather through a &#8220;broad file-grabbing routine&#8221; that&#8217;s designed to look for certain file extensions and specific directory names containing sensitive data.<\/p>\n<p>This included the following files &#8211;<\/p>\n<ul>\n<li>openclaw.json, which contains details related to the OpenClaw gateway token, along with the victim&#8217;s redacted email address and workspace path.<\/li>\n<li>device.json, which contains cryptographic keys for secure pairing and signing operations within the OpenClaw ecosystem.<\/li>\n<li>soul.md, which contains details of the agent&#8217;s core operational principles, behavioral guidelines, and ethical boundaries.<\/li>\n<\/ul>\n<p>It&#8217;s worth noting that the theft of the gateway authentication token can allow an attacker to connect to the victim&#8217;s local OpenClaw instance remotely if the port is exposed, or even masquerade as the client in authenticated requests to the AI gateway.<\/p>\n<p><img decoding=\"async\" alt=\"\" border=\"0\" data-original-height=\"761\" data-original-width=\"925\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhXmaxLqVhpMpdIjbRs0CyGv8auUnhAM_mnVUZlqq8xYfX66z5r6takHTkuVchN4XdmLR2Skv02qsOLaBCy2ZIQR_6cmyyZVM7WyN8pRDiml3aMbELl0mFv0cANQ5Iw4RaZCMr0S9XWMrYj_RKXEjgNkNfvFLqwUEPZwFbSfhRMI48gVV4v2l6MaHRWU81B\/s1600\/openclaw.png\"\/><\/p>\n<p>&#8220;While the malware may have been looking for standard &#8216;secrets,&#8217; it inadvertently struck gold by capturing the entire operational context of the user&#8217;s AI assistant,&#8221; Hudson Rock added. &#8220;As AI agents like OpenClaw become more integrated into professional workflows,&#8230;<\/p>\n<p><a href=\"https:\/\/thehackernews.com\/2026\/02\/infostealer-steals-openclaw-ai-agent.html\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Infostealer Steals OpenClaw AI Agent Configuration Files and Gateway Tokens https:\/\/thehackernews.com\/2026\/02\/infostealer-steals-openclaw-ai-agent.html Publish Date: 2026-02-16 13:43:00&#8230;<\/p>\n","protected":false},"author":1,"featured_media":214303,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgeWsmjwrJY11WFbrvqG71cU065qr7gt-yAQRQv18KoDqnPG5x-HWXkFR1wwAmGNT2ujE6p0mlp1VsqvuDBnEokfqkSFtQX0bVdqdOxiZMZ2WXmqqVc1wrPOdZQ8kFgssie0Cs-1dmmyA7_QZzMhMTM0hcFjbXZtrhoTCwJFupvEgmLEYInUaGST-dmzAOz\/s1600\/openclaw-hacked.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,20,24,35,36,32],"class_list":["post-214302","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-artificial-intelligence","tag-cybersecurity","tag-hacker","tag-infostealer","tag-malware"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/214302"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=214302"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/214302\/revisions"}],"predecessor-version":[{"id":214304,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/214302\/revisions\/214304"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/214303"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=214302"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=214302"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=214302"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}