OpenClaw Hologram Rust Infostealer — Multi-Wave Campaign Abusing Hookdeck Webhook Gateway as C2 Relay — Threadlinqs Intelligence
As of 2026-05-30, OpenClaw Hologram Rust Infostealer — Multi-Wave Campaign Abusing Hookdeck Webhook Gateway as C2 Relay is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0480 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Hologram is a previously undocumented six-binary Rust modular implant framework distributed via fake OpenClaw installers since at least February 2026 and disclosed by Netskope Threat Labs on
Hologram is a previously undocumented, modular Rust-based information-stealing implant framework distributed as fake "OpenClaw" installers since at least February 2026. Documented by Netskope Threat Labs on May 7, 2026, the campaign couples a deliberately bloated ~130MB Rust dropper with a six-binary stage-2 framework that targets credentials from over 250 cryptocurrency wallet and password-manager browser extensions, plus a separately staged Ledger Live module. Hologram introduces two tradecraft elements not previously observed in commodity crimeware: weaponization of Hookdeck (a legitimate webhook gateway service) as a victim-telemetry C2 relay, and the first observed criminal use of the clroxide Rust crate to perform CLR-based process injection.
Victims are funneled to the typosquat domain openclaw-installer.com (registered 2026-03-09 via an Alibaba-affiliated Chinese registrar and fronted by Cloudflare), which serves a 7-Zip archive named OpenClaw_x64.7z, distributed in part through the GitHub typosquat organization openclaw-install/openclaw-installer (created via throwaway account bgodimpulse7) impersonating the legitimate openclaw/openclaw repository. The archive contains OpenClaw_x64.exe, a deliberately bloated ~130MB Rust binary built with stable-x86_64-pc-windows-msvc whose Cargo build path C:\Users\root\.cargo\ leaks the operator development environment. The PE manifest identifies the implant by its internal name, Hologram, with a description ("Decoy entity generator for tactical misdirection.") and version v1.7.16 — evidence of structured internal development. The 130MB pad simultaneously defeats AV file-size scanning heuristics and exceeds the upload cap of many automated sandbox services.
Hologram performs aggressive layered anti-analysis before executing its second stage. Checks include VirtualBox BIOS string queries, sandbox-associated DLL enumeration, VM-prefixed MAC address detection, blacklisted username comparison, and a multi-attribute hardware fingerprint score over GPU, CPU core count, RAM, disk size, running process count, and screen resolution. The implant additionally requires real user activity via a mouse-movement gate, defeating sandboxes that do not simulate input. In wave 3 (Pathfinder), the driver-list enumeration was replaced by a BIOS string query, indicating active operator iteration on detection-evasion logic.
Stage 1 is a Base64+XOR (key 44) obfuscated PowerShell loader. It disables Microsoft Defender (kill, six exclusion paths covering C:\Users\Public\ and the redundant copy locations, cloud blocking off, behavior monitoring off), splits cmdlet names into string fragments to evade signature-based AMSI rules, and opens inbound Windows Firewall rules on TCP/57001, 57002, and 56001. The stage-2 framework is dropped into C:\Users\Public\ with redundant copies under the user''s Documents, Music, Pictures, and Videos folders to defeat single-path remediation.
Stage 2 is a six-binary modular framework — svc_service.exe, virtnetwork.exe, audioeq.exe, OneSync.exe, WinHealhCare.exe, and onedrive_sync.exe — packed with a custom internal packer ("stealth_packer") that shares a build environment with the wave-1 Huntress-documented February 2026 samples, anchoring continuity of operator identity across waves. Five binaries are 64-bit Rust; onedrive_sync.exe is the lone 32-bit Rust binary. The newest core binaries (virtnetwork.exe, audioeq.exe) were compiled 2026-04-27 — one week pre-publication — confirming active development. Persistence is established with a malicious OneDriveSync.lnk in the system Startup folder, supplemented by a WinLogon Userinit registry hijack, a privileged scheduled task, and COM hijacking. Process injection leverages the clroxide Rust crate (first criminal use) and reflective PE loading via memexec, with thread injection performed via direct NT system-call stubs to bypass user-mode EDR API hooks.
The C2 architecture pairs a primary server (assessed as a hijacked Brazilian l
Target sectors: consumer, cryptocurrency, financial, technology
Target regions: Global, North America, Europe, South America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1608, T1189, T1204.002, T1059.001, T1106, T1547.001, T1547.004, T1546.015, T1053.005