ClawHub Developers Face Phishing and Credential Leak Risks

On March 13, 2026, 23pds, Chief Information Security Officer of SlowMist Technology, warned ClawHub developers about phishing and credential leakage risks associated with their one-click GitHub login feature. This warning follows the previous incident involving the Sha1-Hulud worm, which compromised numerous GitHub credentials. The potential attack vector involves credential theft leading to unauthorized access to ClawHub, where attackers could publish malicious skills that implant backdoors in user systems. Users downloading and executing these malicious codes could face significant system intrusions. The warning emphasizes the need for developers to enhance their security practices to mitigate these risks.

Key Points: • ClawHub developers are at risk of phishing and credential leakage due to GitHub login reliance. • The Sha1-Hulud worm previously compromised many GitHub credentials, raising security concerns. • Attackers could exploit stolen credentials to publish malicious skills on ClawHub, leading to system intrusions.