Fake troubleshooting tip on ClawHub leads to infostealer infection A new malware delivery campaign has hit ClawHub, the official online repository for “skills” that augment the capabilities of the popular OpenClaw AI agent. Unlike previous ones, this campaign does not aim to trick users into downloading a bogus, malicious skill. Instead, the threat actor is leaving this particular comment on popular legitimate skills published by others: The malicious troubleshooting comment “At first glance, this appears to be a troubleshooting suggestion. It is not. It is a malware loader,” the OpenGuardrails research team warns. When the Base64-encoded payload is decoded, it reaveals a commang that downloads a shellcode loader from 91[.]92[.]242[.]30, removes macOS quarantine attributes, and delivers…