Acronis TRU Cyber Pulse 2026 finds 575+ malicious OpenClaw skills hit Windows, macOS

A single operator managed operations spanning numerous nations during an investigation dubbed BOSSAI, where researchers uncovered a sophisticated setup involving over ten AI models linked to tools designed for reconnaissance, scanning, and exploitation. This coordinated activity, detailed in the Acronis TRU Cyber Pulse 2026, shows that cybercriminals are increasingly leveraging AI agents to orchestrate cyberattacks, utilizing stolen login information to gain entry to connected services, and deploying utilities that disrupt both intrusion detection mechanisms and system restoration processes. Furthermore, the findings reveal that this operator utilized platforms such as WeChat and LINE to delegate assignments, observe the actions of their agents, and more. This intelligence, which noted that over 575 malicious OpenClaw skills successfully delivered malware to both Windows and macOS systems, was initially published on Help Net Security.