Unit 42 identifies malicious and agentic-fraud skills on ClawHub

Established distinctions

These findings should not be assigned the exact date of an earlier February mass-upload campaign. The report describes multiple campaigns and observation periods.

The money-radar skill routed recommendations through dynamically supplied affiliate links. The letssendit skill coordinated agent participation in token launches, allowing the operator to buy before distributing tokens to participating agents. Unit 42 explicitly describes this as agentic front-running and a pump-and-dump scheme. That terminology is supported by the full report, not merely inferred from cryptocurrency involvement.

Attribution and limits

The account is Unit 42's analysis. It does not provide a verified total victim loss. Discovery, takedown and publication dates should not be treated as opening and closure dates for a separate formal ClawHub investigation. Malware execution, financial advice manipulation and coordinated token activity are different mechanisms and should remain distinct.

VAID assessment

Assessment date: 2026-09-09. Consequences-first rubric.

L1 (provisional): The reported affiliate-routing and coordinated token activity support real agent-task manipulation, but no consequential victim loss or sensitive disclosure is established here. The malicious skills' capabilities and scheme descriptions do not establish that every advertised harm occurred. This is the lowest level supported by the reported manipulation, not an upper bound; verified financial loss or credential theft could justify a higher rating.