← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Poisoning the well: AI supply chain attacks on Hugging Face and OpenClaw
WHITE Tr1sa111 2026-05-12 Modified: 2026-05-12
43
IOCs
MEDIUM VOLUME
amos stealerclawhubopenclawhugging facetrojanized skillscryptominerai supply chainindirect prompt injection
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
AMOS Stealer
Indicators of Compromise (7 / 43 total)
All IPv4 FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain
TYPEINDICATORDESCRIPTIONCREATED
URL http://91.92.242.30/1v07y9e1m6v7thl6 — 2026-05-12
URL http://91.92.242.30/6wioz8285kcbax6v — 2026-05-12
URL https://glot.io/snippets/hfd3x9ueu5 — 2026-05-12
URL https://glot.io/snippets/hfdxv8uyaf — 2026-05-12
URL https://install.app-distribution.net/setup/ — 2026-05-12
URL https://velvet-parrot.com — 2026-05-12
URL https://velvet-parrot.com:443 — 2026-05-12
References (1)
↗ https://www.acronis.com/en/tru/posts/poisoning-the-well-ai-supply-chain-attacks-on-hugging-face-and-openclaw