A ClawHub plugin has been discovered covertly transforming AI assistants into cryptocurrency-earning "workers" for others. Ax Sharma, Research Lead at Manifold, identified that a user named "imaflytok" published 30 plugins, amassing around 9,800 downloads. These plugins, disguised as common utilities, secretly register AI assistants with third-party servers, generate cryptocurrency wallets, and hand over private keys without user consent. The plugins execute tasks every four hours, bypassing detection as they contain no malicious code, highlighting a significant oversight in plugin store review mechanisms.