A sophisticated Rust-based infostealer is being spread through a fake OpenClaw installer. The initial dropper, tracked as Hologram, applies multiple sandbox-evasion techniques before deploying a six-component modular implant. The operation also abuses legitimate platforms such as Azure DevOps, Telegram, and Hookdeck for command-and-control and dead-drop delivery. Its primary objective is to steal credentials from cryptocurrency wallet and password manager browser extensions.
Netskope Threat Labs examined two campaign waves, Hologram and Pathfinder, and mapped the full infection chain from the fraudulent installer to the final credential-theft modules. Their analysis uncovered anti-VM checks, a mouse-movement requirement, a PowerShell runner that disables Microsoft Defender, and several persistence methods, including Run keys, a Winlogon userinit hijack, scheduled tasks, and COM hijacking. Researchers also observed frequent infrastructure changes across domains, Telegram channels, and Hookdeck webhooks.
Defenders should block downloads of the fake OpenClaw installer and watch for the large 130 MB Rust PE associated with the campaign. Security teams should also detect creation of the OneDriveSync.lnk shortcut in the Startup folder and monitor registry modifications involving Winlogon userinit . Outbound access to Azure DevOps, Telegram API, and Hookdeck endpoints should be tightly controlled on non-developer systems. Firewall rules should also prevent inbound connections on ports 56001 through 57002 .
If the threat is detected, isolate the affected endpoint immediately, collect the dropped binaries and related files, and perform forensic analysis of registry changes and scheduled task artifacts. Any exposed Azure DevOps tokens should be revoked, and compromised Telegram bot credentials should be rotated. Detection content should then be updated to include the observed mutex, filenames, and network indicators. Relevant stakeholders should be informed, and reporting to CERT or the impacted service providers should be considered.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands:
An adversary obtains the malicious OpenClaw fake installer ( OpenClaw_x64.exe ). The user, believing it to be a legitimate wallet tool, executes the installer ( T1204 ). The installer immediately launches a single command line that spawns the six malicious payload binaries in one go, allowing it to bypass sandbox heuristics and establish a modular implant framework ( T1027.009 , T1608.001 , T1546.016 , T1127 ).
The exact command line expected by the rule is:
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
