Fake OpenClaw Installers Deliver Rust Malware Targeting Crypto Wallets and Password Managers

May 7, 2026 · Original article ↗

Summary

Netskope details three waves of a fake OpenClaw installer campaign delivering Rust malware that evades sandboxes, steals credentials from more than 250 browser extensions, and uses layered C2 infrastructure. Hookdeck disabled an abused relay endpoint.

Key points

The campaign uses a typosquatted OpenClaw installer site to deliver oversized, password-protected malware archives.
The Hologram dropper checks for virtual machines and sandbox traits, and waits for mouse movement before continuing.
Its six-binary implant uses multiple persistence methods, in-memory payload execution, and direct NT syscalls to evade user-mode EDR hooks.
A server-configurable manifest targets 201 crypto-wallet extensions and 49 password-manager or authenticator extensions; a separate module targets Ledger Live.
The malware relays Telegram check-ins through Hookdeck and uses Telegram, paste sites, Azure DevOps, and rotating C2 infrastructure.
Netskope identified a third wave, Pathfinder, with rotated infrastructure and additional binaries, including Vidar.
Hookdeck disabled the endpoint used in the fake distribution after Netskope reported the abuse; the report also publishes IOCs and YARA rules.

Article Details

Attack Vectors: A fake OpenClaw installer distributed a Rust dropper through a typosquatted website and GitHub organization.
The dropper used anti-VM checks, hardware profiling, and a mouse-movement gate to evade automated sandbox analysis.
The dropper used obfuscated PowerShell to disable Microsoft Defender protections, open inbound firewall ports, and download stage-two payloads.
The implant used Telegram dead drops and a Hookdeck webhook relay for C2 configuration and victim telemetry.
The framework used multiple persistence methods, including a startup-folder shortcut, Run-key autoruns, a WinLogon Userinit hijack, scheduled tasks, and COM hijacking.
The framework targeted browser extensions associated with cryptocurrency wallets, password managers, and 2FA authenticators, and included a separate Ledger Live theft path.
The framework used in-memory CLR loading, reflective PE execution, and direct NT syscall thread injection.
Defensive Notes: Netskope reports that Advanced Threat Protection detects and blocks the stage-two binaries, and that C2 infrastructure artifacts are included in its threat intelligence.
Monitor for large executables, sandbox-evasion behavior, and PowerShell launched by dropped binaries with cmdlet names fragmented at runtime.
Monitor outbound webhook-relay and Telegram connections from non-user processes, and Azure DevOps access from non-development processes.
Monitor programmatic inbound firewall rules on ports 56001–57002 and behavioral signs of persistence or thread injection.
The article advises treating listed IOCs as a starting point because the operator rotated infrastructure during analysis.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`frr[.]rubensbruno[.]adv[.]br`	Hologram primary C2 on a subdomain the article assesses was added to a compromised Brazilian law-firm domain.
DOMAIN	`hkdk[.]events`	Listed as the campaign's C2 relay domain; the specific webhook endpoint is also reported.
DOMAIN	`hwd[.]hidayahnetwork[.]com`	Pathfinder primary C2 domain.
DOMAIN	`jollymccalister[.]lol`	Historical Hologram dead C2 domain.
DOMAIN	`mikolirentryifosttry[.]info`	Hologram secondary C2 and check-in domain, routed through the Hookdeck relay.
DOMAIN	`openclaw-installer[.]com`	Typosquatted fake installer site used to deliver the dropper.
DOMAIN	`serverconect[.]cc`	Hologram C2 rotation domain and loader-staging infrastructure.
DOMAIN	`steamhostserver[.]cc`	Hologram C2 rotation domain associated with the svc_service.exe beacon.
DOMAIN	`transcloud[.]cc`	Hologram C2 associated with svc_service.exe.
DOMAIN	`zkevopenanu[.]cfd`	Pathfinder secondary C2 domain.
IPV4	`147[.]45[.]197[.]92`	Encrypted beacon endpoint for a nested payload, also reported as overlapping with GhostSocks.
IPV4	`185[.]196[.]9[.]98`	Resolution infrastructure associated with the Hologram C2 domain transcloud.cc.
IPV4	`188[.]114[.]97[.]3`	Proxy address for the Hologram primary C2 subdomain.
IPV4	`193[.]202[.]84[.]14`	Pathfinder svc_service.exe wave-two C2 beacon endpoint.
IPV4	`45[.]55[.]35[.]48`	Hologram svc_service.exe C2 beacon endpoint.
IPV4	`86[.]54[.]42[.]72`	Historical resolution address for the dead Hologram C2 jollymccalister.lol.
IPV4	`91[.]92[.]242[.]30`	Listed Hologram threat infrastructure.
IPV4	`94[.]228[.]161[.]88`	Encrypted beacon endpoint for a nested payload.
SHA256	`0c4a9d3579485eaf8801e5ac479cd322ee1e7161b54cc24689b891fa82ba0f1e`	Hash of audioeq.exe, the Hologram system fingerprinter.
SHA256	`1478ccc61b69cee462ea98621ba53adf2de0ce28355c5c4eafaed6d779c8acda`	Hash of dbau.exe, a Pathfinder stage-two binary whose behavior was not identified.
SHA256	`4014048f8e60d39f724d5b1ae34210ffeac151e1f2d4813dbb51c719d4ad7c3a`	Hash of the Hologram dropper OpenClaw_x64.exe.
SHA256	`40fc240febf2441d58a7e2554e4590e172bfefd289a5d9fa6781de38e266b378`	Hash of svc_service.exe, the Hologram C2 beacon and CLR loader.
SHA256	`4fcfcb83145223cca6db85e7c840876ec8a56d78efba856ab70287b0e5c8a696`	Hash of the Pathfinder svc_service.exe C2 beacon.
SHA256	`605096b9729bd8eedab460dbd4baf702029fb59842020a27fc0f99fd2ef63040`	Hash of virtnetwork.exe, the Hologram HTTPS C2 tunnel.
SHA256	`6ae9f9cfa8e638e933ad8b06de7434c395ec68ee9cc4e735069bfb64646bb180`	Hash of onedrive_sync.exe, the Hologram reflective PE loader.
SHA256	`787a28aff72f2ecd2f5e75baf284e61bda9ab8dd3905822c6f620cce809952e8`	Hash of vicloud.exe, identified as a Pathfinder Vidar infostealer.
SHA256	`d5dffba463beae207aee339f88a18cfcd2ea2cd3e36e98d27297d819a1809846`	Hash of OneSync.exe, a Hologram Telegram-bot dropper.
SHA256	`f03736fadffcb7bef122d25d6ace8044378d4fa455f7f48081a3b32c80eb4ed2`	Hash of the Hologram dropper container archive OpenClaw_x64.7z.
SHA256	`f554b6f34fd2710929d74af550ddb50633d36eaf0533f2d0cbbde75670676486`	Hash of the Pathfinder dropper OpenClaw_x64.exe.
SHA256	`fd67063ffb0bcde44dca5fea09cc0913150161d7cb13cffc2a001a0894f12690`	Hash of WinHealhCare.exe, a Hologram Telegram-bot dropper.
URL	`hxxps[:]//dev[.]azure[.]com/sagonbretzpr/`	Attacker-controlled Azure DevOps organization used for payload staging.
URL	`hxxps[:]//pastebin[.]com/raw/csi5UqpEw`	Hologram dead-drop resource.
URL	`hxxps[:]//pastebin[.]com/raw/fTxiyhbL`	Hologram dead-drop resource.
URL	`hxxps[:]//pastebin[.]com/raw/M6KthA5Z`	Hologram dead-drop resource.
URL	`hxxps[:]//pastebin[.]com/raw/mcwWi1Ue`	Hologram dead-drop resource.
URL	`hxxps[:]//pastebin[.]com/raw/w6BVFFWQ`	Pathfinder primary URL dead-drop.
URL	`hxxps[:]//snippet[.]host/efguhk/raw`	Hologram dead-drop resource used for password and later Azure DevOps staging URLs.
URL	`hxxps[:]//snippet[.]host/iqqmib/raw`	Hologram dead-drop URL.
URL	`hxxps[:]//snippet[.]host/uikosx/raw`	Dead-drop URL listed for both Hologram and Pathfinder waves.
URL	`hxxps[:]//snippet[.]host/wtbtew/raw`	Hologram dead-drop URL.