ClawHavoc Malicious Skill File Download via ClawHub API

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects anomalous HTTP GET requests targeting the ClawHub API for 'skills' that match known patterns of malicious file downloads, specifically identifying poc.py scripts or skill.md files which are indicative of the ClawHavoc campaign activity.