Back Panewslab

SlowMist: ClawHub developers beware of phishing and credential leakage risks

Panewslab • March 13, 2026

PANews reported on March 13 that 23pds, Chief Information Security Officer of SlowMist Technology, issued a warning to ClawHub developers the risks of phishing and credential leakage. ClawHub currently relies on developers' one-click login via GitHub. Previously, the Sha1-Hulud worm stole a large number of developers' GitHub credentials, and attackers may use this opportunity to attack Skills.

The attack path is as follows: credential theft → attacker gains GitHub privileges → logs into ClawHub as a developer → publishes malicious skills to implant a backdoor → user downloads and installs the malicious code, leading to system intrusion.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClawHub Developers Face Phishing and Credential Leak Risks On March 13, 2026, 23pds, Chief Information Security Officer of SlowMist Technology, warned ClawHub developers about phishing and credential leakage risks associated with their one-click GitHub login feature. This warning follows the previous incident involving the Sha1-Hulud worm, which compromised numerous GitHub credentials. The potential attack vector involves credential theft leading to unauthorized access to ClawHub, where attackers could publish malicious skills that implant backdoors in user systems. Users downloading and executing these malicious codes could face significant system intrusions. The warning emphasizes the need for developers to enhance their security practices to mitigate these risks. 5 sources 52

Extracted Entities

SlowMist: ClawHub developers beware of phishing and credential leakage risks

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)