GoPlus: ClawHub has a vulnerability that allows for download count forgery, and popular skills may contain malicious code
By: www.chaincatcher.com|03/26/2026 11:51:10
0
Share
Prefer us on Google
According to a security alert released by GoPlus Security, Silverfort security researchers discovered a serious vulnerability in OpenClaw's skill repository ClawHub. Attackers can bypass all protective mechanisms by calling the internal function downloads:increment, allowing them to inflate the download count to over 20,000 in just a few minutes with a single curl request, thereby pushing malicious skills to the top of search rankings and enticing users or AI Agents to install them automatically.
Once the malicious skill is running, it can steal sensitive data such as cryptocurrency wallets and API keys. The vulnerability has been patched within 24 hours. GoPlus advises users that a high download count does not equal safety and recommends using AgentGuard for security scanning and protection.
-- Price
--
--
--
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like
Projects for Modernizing Kindergartens and Purchasing Trolleybuses Completed in Ternopil
Neros Completes $250 Million Financing, Valuation Reaches $2.5 Billion
GoPlus: ListaDAO's liquidity staking vault was attacked, and the attacker exploited a logical vulnerability to steal funds
GoPlus Security released an analysis stating that the Liquid Staking Vault contract of ListaDAO was attacked due to a business logic flaw. The attacker triggered the share calculation function of the Dividend contract when transferring specific tokens, which affected the reward distribution logic of...
GoPlus discloses a new type of Android malware PromptSpy, which utilizes AI large models to achieve remote control of devices
GoPlus Security warns users to be cautious of a new type of Android malware called PromptSpy. This malware lures users into downloading APK files through phishing websites (such as those disguised as bank websites) and can remotely control devices after obtaining accessibility permissions.What makes...
Unveiling the Movement Liquidity Provider Sell-Off Scandal: Secret Contracts, Shadow Advisors, and Hidden Intermediaries
The governance structure and collaboration mechanism of Movement Labs have been called into question, with internal conflicts and information confusion making it difficult to dispel the impression of "insider trading." Meanwhile, the project team is attempting to shift responsibility towards external operators.
Unveiling the Movement Liquidity Provider Sell-Off Scandal: Secret Contracts, Shadow Advisors, and Hidden Intermediaries
The governance structure and collaboration mechanism of Movement Labs have been called into question, with internal conflicts and information confusion making it difficult to dispel the impression of "insider trading." Meanwhile, the project team is attempting to shift responsibility towards external operators.
Bitcoin Threatened by a Fragile American Economy and Persistent Inflation
Why Prediction Markets Got the Brazilian Election So Wrong
Crypto Scam from a Wrong Number: $140,000 Vanished in Canada
A resident of Guelph, Canada, lost 140,000 dollars in a crypto scam that originated from a "wrong number" SMS. A look back at the pig butchering trap.
Key Week for Central Banks: The Fed, ECB, and BoJ Decide on Their Rates
The most important central banks globally will meet this week, in a context where oil prices remain the main factor behind the increase in global inflation.
Ethereum Foundation backs default wallet privacy as Kohaku work advances
Manus quietly released its 2.0 declaration
It discusses how organizations utilize AI to evolve, revealing the company's product direction, cost logic, and hiring standards.
Justin Sun Prize Partners With MathDB, Led by Caltech Professor Tony Yue Yu, on 50-Problem Pilot
CFTC advances voluntary crypto exchange registration as Congress stalls
Crypto: Over 10,000 Claims Against Restrictions by British Banks
Nearly 10,000 complaints target British banks for blocked crypto transfers. NatWest caps, anti-fraud rules, FCA timeline: a breakdown.
AI agents are launching memecoins. MemeToro’s agent answers to open code
Crypto: The Tokenization of RWA Concerns American Conservatives
Pump.fun 'optimized for addiction': what the internal messages cited in court really say
Pump.fun was allegedly designed to be addictive: what the internal messages cited in the class action in New York say, and what the judge retained.
Anthony Pompliano: The State Will Never Stop Printing Money! Bitcoin, Gold, and Land Will Benefit for 20 Years
Blocked Stablecoin: Your Private Key Is Not Enough
Cryptocurrencies Seek to Integrate into Finance
Introducing the Best Meme Coins on the Ripple Network: A Review of 5 Popular XRPL Tokens
Bitcoin's next Fed test comes with a hidden problem in America's inflation data
Bitcoin's $80,000 support faces a fresh Fed test as US inflation data collection remains below 67% ahead of the October 28 decision.
The crypto market loses altitude, patience becomes a habit – Steady Lads
Bitcoin weakens its supports, Ethereum loses $2,400. Cara analyzes the crypto market for Steady Lads and emphasizes caution ahead of the Fed.
Stablecoin Payments in Europe: How Do CASP, PI, and EMI Fit Together?
Why 22 Trillion-Dollar Giants Refuse to be 'Tokenized'?
Rayls Bridges Traditional Finance and Decentralized Finance
Is 24/7 Trading a Necessity? Analyzing the Real Trading Rhythm of RWA Perpetual Contracts
Cyberattack on GMO in Japan: Trading Accounts Compromised, GMO Coin Claims to be Unaffected
GMO hacking in Japan: forex trading accounts compromised via its VPS, ransom refused. The exchange GMO Coin claims to be unaffected. Here's the update.
Elon Musk's Grand Scheme to Undermine New Cloud Providers
Projects for Modernizing Kindergartens and Purchasing Trolleybuses Completed in Ternopil
Neros Completes $250 Million Financing, Valuation Reaches $2.5 Billion
GoPlus: ListaDAO's liquidity staking vault was attacked, and the attacker exploited a logical vulnerability to steal funds
GoPlus Security released an analysis stating that the Liquid Staking Vault contract of ListaDAO was attacked due to a business logic flaw. The attacker triggered the share calculation function of the Dividend contract when transferring specific tokens, which affected the reward distribution logic of...
GoPlus discloses a new type of Android malware PromptSpy, which utilizes AI large models to achieve remote control of devices
GoPlus Security warns users to be cautious of a new type of Android malware called PromptSpy. This malware lures users into downloading APK files through phishing websites (such as those disguised as bank websites) and can remotely control devices after obtaining accessibility permissions.What makes...
Unveiling the Movement Liquidity Provider Sell-Off Scandal: Secret Contracts, Shadow Advisors, and Hidden Intermediaries
The governance structure and collaboration mechanism of Movement Labs have been called into question, with internal conflicts and information confusion making it difficult to dispel the impression of "insider trading." Meanwhile, the project team is attempting to shift responsibility towards external operators.
Unveiling the Movement Liquidity Provider Sell-Off Scandal: Secret Contracts, Shadow Advisors, and Hidden Intermediaries
The governance structure and collaboration mechanism of Movement Labs have been called into question, with internal conflicts and information confusion making it difficult to dispel the impression of "insider trading." Meanwhile, the project team is attempting to shift responsibility towards external operators.
...
Contents
Latest articles
10/26/2026
Latest coin listings on WEEX
Customer Support:@weikecs
Business Cooperation:@weikecs
Quant Trading & MM:bd@weex.com
VIP Program:support@weex.com
