Back Bitget

SlowMist: ClawHub developers should be aware of phishing and credential leakage risks

Bitget • March 13, 2026

PANews, March 13 - 23pds, Chief Information Security Officer of SlowMist Technology, issued a reminder that ClawHub developers should be aware of phishing and credential leakage risks. Currently, ClawHub relies on developers' Github one-click login. Previously, the Sha1-Hulud worm stole a large number of developers' GitHub credentials, and attackers may take the opportunity to attack Skills.

The attack path is: credential theft → attacker obtains GitHub permissions → logs into ClawHub as a developer → publishes malicious Skills to implant backdoors → users download and install, then execute malicious code, resulting in system intrusion.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClawHub Developers Face Phishing and Credential Leak Risks On March 13, 2026, 23pds, Chief Information Security Officer of SlowMist Technology, warned ClawHub developers about phishing and credential leakage risks associated with their one-click GitHub login feature. This warning follows the previous incident involving the Sha1-Hulud worm, which compromised numerous GitHub credentials. The potential attack vector involves credential theft leading to unauthorized access to ClawHub, where attackers could publish malicious skills that implant backdoors in user systems. Users downloading and executing these malicious codes could face significant system intrusions. The warning emphasizes the need for developers to enhance their security practices to mitigate these risks. 5 sources 52

Extracted Entities

SlowMist: ClawHub developers should be aware of phishing and credential leakage risks

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)