ClawdBot Analysis – Hudson Rock
Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<h1>ClawdBot: The New Primary Target for Infostealers in the AI Era</h1>
<div>
<i></i> January 26, 2026
<i></i> Hudson Rock Research
</div>
<p>
The rise of “Local-First” AI agents has introduced a new, highly lucrative attack surface for cybercriminals.
<strong>ClawdBot</strong>, a rapidly growing open-source personal AI assistant, shifts the locus of computation from the cloud to the user’s local filesystem.
</p>
<p>
While this offers privacy from big tech, it creates a “honey pot” for commodity malware. Our analysis confirms that ClawdBot stores sensitive “memories,” user profiles, and critical authentication tokens in <strong>plaintext Markdown and JSON files</strong>.
</p>
<div>
Critical Insight: Cognitive Context Theft
For infostealers, this data is unique. It isn’t just about stealing a password; it is about <strong>Cognitive Context Theft</strong>.
Files like <code>MEMORY.md</code> provide a psychological dossier of the user – what they are working on, who they trust, and their private anxieties – enabling perfect social engineering.
</div>
<h2>The Anatomy of an AI Leak</h2>
<p>
ClawdBot maintains persistent state in directories like <code>~/.clawdbot/</code> and <code>~/clawd/</code>.
Unlike encrypted browser stores or OS Keychains, these files are often readable by any process running as the user.
</p>
<p>
Below is a reconstruction of the file structure we expect infostealers to begin targeting specifically.
Note the critical presence of the **Gateway Token**, which can allow for Remote Code Execution (RCE).
</p>
<div>
<div>
<div>
<i></i> ~/clawd/memory/memory.md
</div>
<div><div></div>## Session Summary: 2026-01-24
– User asked to save VPN configuration for remote work.
– VPN_GATEWAY: vpn.corporatenet.com (Cisco AnyConnect)
– VPN_GROUP_KEY: “T3chC0rp_Rem0te_Users”
– VPN_STATIC_PASS: “Winter2026!Secure”
– User mentioned: “I need to log into the Change Healthcare portal by 9 AM.”
– # Note: This context reveals the target organization.
<div>
<div>
<i></i> ~/.clawdbot/clawdbot.json
</div>
<div><div></div>// The Master Config: Controls the Agent Gateway
{
“gateway”: {
“port”: 3000,
“auth”: {
“mode”: “token”,
“token”: “cl_live_99283…RCE_RISK…”
}
},
“allowlist”: [“+15550199”, “admin_user”]
}
// ATTENTION: If this token is stolen, the attacker can remotely
// execute shell commands on the victim machine via the Gateway.
</div>
<h2>Real World Precedents: From Memory to Breach</h2>
<p>
Why are we so concerned about a text file containing VPN or Gateway keys? Because history shows that **single compromised credentials** are the root cause of the largest cyber breaches in recent history.
</p>
<div>
<div>
Case Study 1: VPN Compromise
Ransomware
</div>
<div>
<h3>The $22 Million Key: Change Healthcare</h3>
<p>
In 2024, the Change Healthcare ransomware attack resulted in a staggering <strong>$22,000,000</strong> payout.
The entry point? A single compromised Citrix/VPN credential found on an employee’s machine infected by an infostealer.
</p>
<p>
If an AI agent like ClawdBot had stored these VPN details in <code>memory.md</code> for “easy access,” the infostealer wouldn’t have needed to dig deep. It would be served on a silver platter.
</p>
<div>
<div>
<i></i> HUDSON ROCK CAVALIER: Compromised Cisco VPN Credentials
</div>
<div>
Cisco (CSCOE)
<div><div></div></div>
2,500+
</div>
<div>
Fortinet
<div><div></div></div>
1,800+
</div>
<div>
Pulse Secure
<div><div></div></div>
1,200+
</div>
</div>
</div>
</div>
<div>
<div>
Case Study 2: Collaboration Tools
Data Leak
</div>
<div>
<h3>The Atlassian & Jira Attack Surface</h3>
<p>
Recent major incidents involving <strong>Hy-Vee</strong> (53GB of Atlassian data stolen) and <strong>Jaguar Land Rover</strong> (breached by Hellcat Ransomware via Jira) demonstrate the catastrophe of compromised collaboration credentials.
</p>
<p>
Infostealers grab session cookies or API tokens for Jira, Confluence, and Atlassian, allowing groups like <strong>Hellcat</strong> and <strong>Stormous</strong> to bypass authentication and exfiltrate internal wikis, tickets, and documentation.
</p>
<p>
ClawdBot’s <code>auth-profiles.json</code> or <code>tools.md</code> often store these exact API tokens to enable features like “summarize this ticket” or “search internal wiki.” Storing these in plaintext grants attackers the keys to the entire corporate knowledge base.
</p>
<div>
<div>
<i></i> ATTACK CHAIN: Jira/Atlassian Credential Abuse
</div>
<table>
<thead>
<tr>
<th>Victim</th>
<th>Asset Stolen</th>
<th>Impact</th>
</tr>
</thead>
<tbody>
<tr>
<td>Hy-Vee</td>
<td>Atlassian Cloud Credentials</td>
<td>53GB Data Heist</td>
</tr>
<tr>
<td>Jaguar Land Rover</td>
<td>Jira Access Token</td>
<td>Hellcat Ransomware Entry</td>
</tr>
<tr>
<td>Samsung</td>
<td>Ticket System Logins</td>
<td>Massive Data Dump</td>
</tr>
</tbody>
</table>
</div>
</div>
</div>
<h2>How Infostealers Will Adapt</h2>
<p>
We are seeing specific adaptations in major Malware-as-a-Service (MaaS) families to target these “Local-First” directory structures:
</p>
<ul>
<li><strong>RedLine Stealer:</strong> Uses its modular “FileGrabber” to sweep <code>%UserProfile%\.clawdbot\*.json</code>.</li>
<li><strong>Lumma Stealer:</strong> Employs heuristics to identify files named “secret” or “config”, perfectly matching ClawdBot’s naming conventions.</li>
<li><strong>Vidar:</strong> Allows operators to dynamically update target file lists via social media bio pages, enabling instant campaign updates to target <code>~/clawd/</code>.</li>
</ul>
<div>
{<br />
“target”: “ClawdBot”,<br />
“paths”: [<br />
“%USERPROFILE%/.clawdbot/clawdbot.json”,<br />
“%USERPROFILE%/clawd/memory/*.md”,<br />
“%USERPROFILE%/clawd/SOUL.md”<br />
],<br />
“regex”: “(auth.token|sk-ant-|jira_token)”<br />
}
</div>
<h2>Beyond Theft: Memory Poisoning & Persistence</h2>
<p>
The threat is not just exfiltration; it is <strong>Agent Hijacking</strong>. If an attacker gains write access (e.g., via a RAT deployed alongside the stealer), they can engage in “Memory Poisoning.”
</p>
<p>
By modifying <code>SOUL.md</code> or injecting false facts into <code>MEMORY.md</code>, an attacker can permanently alter the AI’s behavior – forcing it to trust malicious domains or exfiltrate future data. This effectively backdoors the user’s digital assistant, turning it into a persistent insider threat.
</p>
<h2>Conclusion & Recommendations</h2>
<p>
ClawdBot represents the future of personal AI, but its security posture relies on an outdated model of endpoint trust.
Without encryption-at-rest or containerization, the “Local-First” AI revolution risks becoming a goldmine for the global cybercrime economy.
</p>
<p>
To learn more about how Hudson Rock protects companies from imminent intrusions caused by info-stealer infections of employees, partners, and users, as well as how we enrich existing cybersecurity solutions with our cybercrime intelligence API, please schedule a call with us, here: <a href="https://www.hudsonrock.com/schedule-demo" rel="noreferrer" target="_blank">https://www.hudsonrock.com/schedule-demo</a>
<br /><br />
We also provide access to various free cybercrime intelligence tools that you can find here: <a href="https://www.hudsonrock.com/free-tools" rel="noreferrer" target="_blank">www.hudsonrock.com/free-tools</a>
<br /><br />
Thanks for reading, Rock Hudson Rock!
<br />
Follow us on LinkedIn: <a href="https://www.linkedin.com/company/hudson-rock" rel="noreferrer" target="_blank">https://www.linkedin.com/company/hudson-rock</a>
<br />
Follow us on Twitter: <a href="https://www.twitter.com/RockHudsonRock" rel="noreferrer" target="_blank">https://www.twitter.com/RockHudsonRock</a>
<br /><br />
h/t to <a href="https://www.linkedin.com/in/kostastsale" rel="noreferrer" target="_blank">Kostas T.</a> for inspiring parts of this blog.
</p>
The post ClawdBot: The New Primary Target for Infostealers in the AI Era appeared first on InfoStealers.
Article Link: ClawdBot: The New Primary Target for Infostealers in the AI Era | InfoStealers