OpenClaw’s Hologram Delivers a Fake Installer and Rust Infostealer

Summary

A sophisticated Rust-based infostealer is being spread through a fake OpenClaw installer. The initial dropper, tracked as Hologram, applies multiple sandbox-evasion techniques before deploying a six-component modular implant. The operation also abuses legitimate platforms such as Azure DevOps, Telegram, and Hookdeck for command-and-control and dead-drop delivery. Its primary objective is to steal credentials from cryptocurrency wallet and password manager browser extensions.

Investigation

Netskope Threat Labs examined two campaign waves, Hologram and Pathfinder, and mapped the full infection chain from the fraudulent installer to the final credential-theft modules. Their analysis uncovered anti-VM checks, a mouse-movement requirement, a PowerShell runner that disables Microsoft Defender, and several persistence methods, including Run keys, a Winlogon userinit hijack, scheduled tasks, and COM hijacking. Researchers also observed frequent infrastructure changes across domains, Telegram channels, and Hookdeck webhooks.

Mitigation

Defenders should block downloads of the fake OpenClaw installer and watch for the large 130 MB Rust PE associated with the campaign. Security teams should also detect creation of the OneDriveSync.lnk shortcut in the Startup folder and monitor registry modifications involving Winlogon userinit. Outbound access to Azure DevOps, Telegram API, and Hookdeck endpoints should be tightly controlled on non-developer systems. Firewall rules should also prevent inbound connections on ports 56001 through 57002.

Response

If the threat is detected, isolate the affected endpoint immediately, collect the dropped binaries and related files, and perform forensic analysis of registry changes and scheduled task artifacts. Any exposed Azure DevOps tokens should be revoked, and compromised Telegram bot credentials should be rotated. Detection content should then be updated to include the observed mutex, filenames, and network indicators. Relevant stakeholders should be informed, and reporting to CERT or the impacted service providers should be considered.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  An adversary obtains the malicious OpenClaw fake installer (OpenClaw_x64.exe).
  The user, believing it to be a legitimate wallet tool, executes the installer (T1204).
  The installer immediately launches a single command line that spawns the six malicious payload binaries in one go, allowing it to bypass sandbox heuristics and establish a modular implant framework (T1027.009, T1608.001, T1546.016, T1127).

  The exact command line expected by the rule is:

  OpenClaw_x64.exe svc_service.exe virtnetwork.exe onedrive_sync.exe audioeq.exe WinHealhCare.exe OneSync.exe

• Regression Test Script:

  # -------------------------------------------------
  # Simulation script – triggers the OpenClaw detection
  # -------------------------------------------------
  $installerPath = "C:TempOpenClaw_x64.exe"
  
  # Ensure the dummy installer exists (create a harmless placeholder)
  if (-not (Test-Path $installerPath)) {
      New-Item -ItemType File -Path $installerPath -Force | Out-Null
  }
  
  # Build the argument list containing all six payload names
  $payloads = @(
      "svc_service.exe",
      "virtnetwork.exe",
      "onedrive_sync.exe",
      "audioeq.exe",
      "WinHealhCare.exe",
      "OneSync.exe"
  )
  $argString = $payloads -join " "
  
  # Launch the installer with the full malicious command line
  Write-Host "Launching malicious installer..."
  Start-Process -FilePath $installerPath -ArgumentList $argString -NoNewWindow
  
  # Wait a few seconds to let Sysmon / Security log the event
  Start-Sleep -Seconds 5
  Write-Host "Simulation complete. Verify SIEM for alert."

• Cleanup Commands:

  # -------------------------------------------------
  # Cleanup script – removes artifacts created for the test
  # -------------------------------------------------
  $installerPath = "C:TempOpenClaw_x64.exe"
  if (Test-Path $installerPath) {
      Remove-Item -Path $installerPath -Force
  }
  
  # Optionally terminate any lingering dummy payload processes (they are just placeholders)
  Get-Process -Name "svc_service","virtnetwork","onedrive_sync","audioeq","WinHealhCare","OneSync" -ErrorAction SilentlyContinue |
      Stop-Process -Force
  Write-Host "Cleanup finished."