安全提醒:ClawHub市场共发现1184个恶意技能,可能窃取SSH密钥、加密钱包等

WELL-6,23%

BlockBeats 消息,2 月 20 日,慢雾创始人余弦转帖发布安全提醒,目前 OpenClaw 的 ClawHub 市场共发现 1184 个恶意技能,这些技能会窃取 SSH 密钥、加密钱包、浏览器密码并打开反向 shell。仅一名攻击者就上传了 677 个软件包。排名第一的技能存在 9 个漏洞,下载量达数千次。

余弦提醒用户,文本不再是文本,而是指令。建议通过独立环境使用 AI 工具,许多 OpenClaw 技能存在潜在风险。此外,Web3 安全里合约只是一部分,真正事故原因早已不仅仅是合约。前几日 Moonwell 被盗 178 万美元,缺陷代码来自 Co-Authored-By:Claude Opus 4.6。

Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to Disclaimer.

Articoli correlati

TRM Labs Reports $35B Lost to Crypto Scams Worldwide in 2025

TRM Labs reports a rise in global crypto fraud, reaching $35 billion in 2025, likely underestimating actual losses. Enhanced training and blockchain tools are essential for law enforcement to combat sophisticated fraud schemes effectively.

TheNewsCrypto6h fa

伊朗、北韓都在用!穩定幣成非法交易首選虛擬資產,涉詐額達 510 億美元

根據FATF報告,穩定幣已成為非法交易的首選資產,尤其在伊朗與北韓等國被廣泛使用。該組織呼籲加強對穩定幣發行商的監管,並指出在2025年,穩定幣將占大部分非法虛擬資產交易。為應對相關挑戰,FATF建議發行商應加強技術能力,以提高監管效率。

区块客6h fa

Address Poisoning Scam: TON Whale Loses $220K, Scammer Returns Most

_A TON blockchain whale sent $220K to a scammer by mistake. The scammer kept $17K and returned the rest with an apology note._ A TON blockchain whale recently fell victim to an address poisoning scam. The incident cost him $220,000 worth of TON tokens. He sent the funds to the wrong wallet by

LiveBTCNews6h fa

OpenClaw出现「自我攻击」漏洞:误执行Bash命令致密钥泄露

GoPlus 报告称,AI 工具 OpenClaw 发生自我攻击安全事件,因错误的 Bash 指令导致敏感环境变量泄露。建议在 AI 开发中使用 API 调用,遵循最小权限原则,限制高风险操作并引入人工审核。

GateNews7h fa

太子集團在台洗錢 107 億!自行開發「OJBK 錢包」連結地下匯兌

台北地檢署偵辦的柬埔寨「太子集團」洗錢案,涉及非法洗錢高達107億,起訴陳志等62人,並查出集團利用USDT與自開發的「OJBK錢包」進行跨境洗錢。陳志指揮在多國設立公司,透過不實交易合約隱匿犯罪所得,並購置豪宅與名車,檢方對其求刑最高13年。

区块客9h fa

New Coruna IOS Exploit Kit Raises Security Risks for Crypto Users

The newly identified "Coruna" exploit kit poses a serious threat to Apple devices, containing 23 sophisticated vulnerabilities that can compromise iPhones across multiple iOS versions. Researchers warn that these tools are circulating in cybercrime markets, emphasizing the need for regular software updates to enhance security.

TodayqNews9h fa
Commento
0/400
Nessun commento