Threat · curated 21 Aug 2026
Attackers Target Agents via The Skill Supply Chain | Zenity Labs
First reported zenity.io
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
The Paperclip skill supply-chain attack shows agentic AI 'skills' are a live, under-defended vector where untrusted natural-language and code recipes can run infostealers on developer machines and harvest cloud credentials at scale.
Zenity Labs disrupted an active malware campaign that targeted AI agents through typosquatted 'skills' impersonating the Paperclip and Browser Use platforms, using trojanized Python/Node packages and a remote loader to deliver a second-stage credential harvester. The malicious skills accumulated over 1.7M aggregate installs on skills.sh, evaded scanners for weeks, and exfiltrated SSH keys, cloud credentials (AWS/GCP/Azure), and dozens of other secrets to attacker C2 at getpaperclipp[.]com; OWASP subsequently published a candidate Agentic Skills Top 10 with Malicious Skills at No. 1.
Summary
Zenity Labs disrupted an active malware campaign that targeted AI agents through the skill supply chain, hitting users of the popular AI tools Paperclip and Browser Use with typosquatted skills, trojanized packages, and a remote loader that delivered a second-stage credential harvester. The campaign is attributed to an actor tracked as Karli, known on GitHub as karli-paperclip.[2]
The Paperclip skill family accumulated installs on skills.sh while still clean, was trojanized on July 11, and trended throughout July; by August 2 the family had amassed more than 1.7 million aggregate (non-user-unique) installs. Trojanized skills evaded automated detection even as scanners caught the accompanying Python packages within hours.[1][2]
On execution the skills ran an infostealer that harvested a wide range of developer and cloud credentials and exfiltrated a base64-encoded bundle to attacker infrastructure at api.getpaperclipp.com/feedback. Vercel and Microsoft/GitHub removed the reported skills, listings, and repositories within 12 hours of Zenity's report, though copied instructions may persist in downstream repositories, aggregators, and user machines.[2]
Attack chain
- Infrastructure setup: The actor reserved a look-alike domain impersonating the Paperclip agentic AI platform and stood up GitHub look-alike orgs and C2 infrastructure; Karli's first observed public GitHub activity was July 2.[1][2]
- Supply-chain seeding: The Paperclip skill family began accumulating skills.sh installs while still clean, then was trojanized on July 11 and trended throughout July, reaching over 1.7M aggregate installs by August 2. Karli also published trojanized PyPI packages browser-use-headless (July 13) and paperclip-ai (July 20).[2]
- Execution and payload delivery: Through different triggers, the trojanized skills caused victim agents to run an infostealer, with a remote loader delivering a second-stage credential harvester.[2]
- Credential collection: The stealer configured more than 100 Unix, macOS, Windows and project-relative paths covering SSH keys; AWS, GCP and Azure credentials; Kubernetes, Docker and Git configuration; npm, PyPI and package-manager tokens; Terraform, Pulumi and database credentials; shell profiles; .env files; CI/CD configuration; and service-account files for Firebase, Vercel, Netlify, Cloudflare and Supabase.[2]
- Exfiltration: Collected data was packaged as a base64-encoded plaintext bundle of host metadata, workspace and home directories, Git identity, and discovered secrets and sent via POST to api.getpaperclipp.com/feedback.[2]
Disclosure timeline
| Date | Event |
|---|---|
| July 2 | Karli's first observed public GitHub activity.[2] |
| July 11 | Paperclip skill family trojanized after accumulating installs while clean.[2] |
| July 13 | Karli published trojanized browser-use-headless to PyPI; spotted in under two hours.[2] |
| July 20 | Karli published trojanized paperclip-ai to PyPI; spotted within the hour.[2] |
| August 2 | skills.sh had amassed more than 1.7 million aggregate installs across the Paperclip skill family.[2] |
| August 6 | Zenity Labs published research disclosing and disrupting the campaign.[1][2] |
Actor profile
Karli (GitHub: karli-paperclip)
Actor who created infostealers, C2 infrastructure, and GitHub look-alike orgs impersonating the Paperclip and Browser Use AI tools. Published trojanized skills and PyPI packages (browser-use-headless, paperclip-ai). First observed public GitHub activity July 2. No further attribution (nation-state or crew) is grounded in the evidence.[1][2]
How it works
AI 'skills' are natural-language and/or coded recipes for agentic platforms that can reference external sites and MCP servers, representing a major source of untrusted input; there is no separation of user-mode and skill-supplied instructions from the model's perspective, which the campaign abused by delivering malicious skills that agents executed.[1][2]
The trojanized skills triggered victim agents to run an infostealer and a remote loader that fetched a second-stage credential harvester, then exfiltrated a base64-encoded plaintext bundle over HTTP POST to attacker infrastructure.[2]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| paperclip-ai (PyPI package) | 0.1.0 and 0.1.1 | Reported and removed from platform within 12 hours; treat installs as compromised/exposure[2] |
| browser-use-headless (PyPI package) | 0.1.4 | Reported and removed from platform within 12 hours; treat installs as compromised/exposure[2] |
| Paperclip / Browser Use agentic skills (getpaperclipai/paperclip, browser-use-headless/browser-use-headless-skill) | Trojanized skill families hosted on skills.sh / GitHub | Skills, listings and repositories removed by Vercel and Microsoft/GitHub within 12 hours; copied instructions may persist downstream[2] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| domain | getpaperclipp.com | Attacker look-alike domain impersonating Paperclip; used to host C2 endpoints.[1][2] |
| domain | api.getpaperclipp.com | Exfiltration and health-check C2 host; stolen data POSTed to /feedback and /health probed.[2] |
| domain | api-v1.getpaperclipp.com | Additional C2 host with a /health endpoint to hunt in egress logs.[2] |
| other | paperclip-ai==0.1.0 / 0.1.1 (PyPI) | Trojanized Python package versions to check for in developer systems.[2] |
| other | browser-use-headless==0.1.4 (PyPI) | Trojanized Python package version to check for in developer systems.[2] |
| other | getpaperclipai/paperclip, browser-use-headless/browser-use-headless-skill | Malicious skill repositories/orgs whose use by agents or developer systems should be checked.[2] |
| other | karli-paperclip | GitHub account of the actor Karli who published the malicious skills and packages.[2] |
Key takeaways
- AI agent 'skills' are a live supply-chain attack surface: trojanized skills evaded automated detection and reached hundreds of thousands of installs while accompanying malicious packages were caught within hours.[1][2]
- Because agents do not separate user instructions from skill-supplied instructions, malicious skills can drive credential theft across a wide range of developer and cloud secrets; organizations need inventory, provenance, and rapid blocking capability for skills.[1][2]
Defensive actions
- Check whether any agents or developer systems used skills from getpaperclipai/paperclip or browser-use-headless/browser-use-headless-skill, or installed browser-use-headless==0.1.4 or paperclip-ai==0.1.0/0.1.1.: Identifies exposure to the trojanized skill families and packages used in the campaign.[2]
- Search egress logs for requests to api.getpaperclipp.com/health, api-v1.getpaperclipp.com/health, and especially POST api.getpaperclipp.com/feedback, correlating matches with host artifacts.: These endpoints are the campaign's C2 and exfiltration channels; matches indicate execution and data theft.[2]
- Treat any agent and its host as compromised if a malicious-version loader or stealer executed; otherwise treat installation/use as an exposure requiring triage and rotate accessible credentials when execution cannot be ruled out.: The stealer harvests SSH keys, cloud and CI/CD credentials, and package-manager tokens, so credential rotation and host remediation are needed after execution.[2]
- Establish visibility and governance over which agents workers use and which skills those agents tap, and the ability to quickly block a skill flagged as malicious across the organization.: Most organizations cannot answer how many agents and skills are running, leaving them unable to respond quickly to a malicious skill incident.[1]