{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0415",
  "aliases": [],
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Vidar variant steals OpenClaw gateway and device secrets",
  "details": "## What\n\nA Vidar variant was reported collecting OpenClaw gateway and device material, including openclaw.json, device keys, and context files such as soul.md, AGENTS.md, and MEMORY.md. The source names one confirmed OpenClaw user; it does not establish a broader infection population.\n\n## Which configuration is exposed\n\nThe target set is any host running OpenClaw with readable gateway tokens, device keys, and personal context files. ACVE can identify the harness presence but cannot determine whether malware infected the host or whether a file was opened.\n\n## How ACVE detects it\n\nThe matcher flags an OpenClaw harness as a target-set review signal. It intentionally does not claim infection, because discovery does not read credential contents and the published sample used generic token and private-key sweeps.\n\n## Fix\n\nRevoke gateway tokens and device keys, sign out connected services, inspect persistence, and restore context files from a trusted backup. Treat the endpoint as compromised and issue fresh short-lived credentials after containment.\n\n## Grounding needed\n\nThe DFIR page should be checked for the confirmed-user statement, file list, and infection date. ACVE can only flag the presence of a target harness, not prove this host was infected.\n\nThis record is limited to the condition named in the public source: Vidar variant steals OpenClaw gateway and device secrets. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "openclaw"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "code",
      "vulnClasses": [
        "credential-theft"
      ],
      "cwe": [
        "CWE-522"
      ],
      "exploitation": {
        "status": "exploited-itw",
        "checkedAt": "2026-09-20T00:00:00Z",
        "sources": [
          {
            "url": "https://www.bleepingcomputer.com/news/security/infostealer-malware-found-stealing-openclaw-secrets-for-first-time/",
            "type": "dfir"
          }
        ],
        "kev": {
          "listed": false
        },
        "first_seen": "2026-02-13",
        "last_seen": "2026-02-16",
        "victims": {
          "count": 1,
          "sectors": [
            "software"
          ],
          "evidence": "Hudson Rock described one confirmed OpenClaw user with the Vidar variant."
        },
        "attribution": "unattributed"
      },
      "cveBoundary": "user-configured",
      "matcher": {
        "field": "harness.id",
        "op": "in",
        "value": [
          "openclaw"
        ]
      },
      "fix": {
        "summary": "Rotate OpenClaw gateway tokens and device keys after infection.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "harness.id",
            "why": "Treat an infected OpenClaw host as compromised."
          },
          {
            "type": "remove",
            "target": "~/.openclaw/openclaw.json and device.json",
            "why": "Remove stolen token material after revocation."
          }
        ]
      },
      "noCveReason": "No CVE assigned; this record describes a configuration or supply-chain condition.",
      "grounding": {
        "itw": {
          "checkedAt": "2026-09-20T16:26:29Z",
          "sources": [
            {
              "url": "https://www.bleepingcomputer.com/news/security/infostealer-malware-found-stealing-openclaw-secrets-for-first-time/",
              "status": 200,
              "contentType": "text/html; charset=UTF-8",
              "sha256": "sha256:b441b4cbd33f926d5ac08151231e40e33825c902d82a903d9c22f761ff375f6e",
              "type": "dfir"
            }
          ],
          "kev": {
            "listed": false
          }
        }
      }
    }
  }
}