Threat reportMalwareTL-2026-1845

Fake AI Developer Tool Installers Delivering Infostealer via SEO Poisoning and Typosquatting

highACTIVE

Fake AI Developer Tool Installers Delivering Infostealer via (TL-2026-1845), also tracked as OpenClaw Hologram Campaign, is a high-severity malware campaign, first published 2026-08-03. It has no confirmed attribution, affects Anthropic Claude Code, maps to 22 MITRE ATT&CK techniques (T1005, T1027, T1053.005), and is covered by 9 detection rules and 24 indicators of compromise.

Severity
HIGHAssessed severity
CVEs
0None referenced
Techniques
22MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
24Indicators of compromise

Key facts for TL-2026-1845

Threat ID
TL-2026-1845
Also known as
OpenClaw Hologram Campaign, SEO Poisoning AI Developer Tools Campaign, ClickFix Developer Lure Campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
Last reviewed
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
software development, technology, cryptocurrency, gaming
Target regions
North America, Europe, united kingdom, united states of america
Detection rules
9
Indicators of compromise
24

Malware and tooling in Fake AI Developer Tool Installers Delivering Infostealer via

Malware and tooling: AMOS, GhostSocks, GhostSocks, Hookdeck

How Fake AI Developer Tool Installers Delivering Infostealer via works

A financially motivated eCrime campaign targeting software developers with fake installers impersonating Claude Code, Google Gemini CLI, and the OpenClaw project. SEO-poisoned search results and typosquatted domains deliver a fileless PowerShell infostealer (Gemini/Claude impersonation) and a Rust-based six-module implant framework called Hologram (OpenClaw impersonation) that steal credentials, session cookies, crypto wallet data, and CI/CD secrets.

This campaign encompasses two highly correlated attack vectors — both leveraging typosquatting and social engineering to deliver infostealer malware to developer workstations. The first vector, documented by EclecticIQ and Infosecurity Magazine, uses SEO poisoning to place typosquatted domains such as 'geminicli.co.com' and 'claudecode.co.com' above legitimate search results for 'install Gemini CLI' and 'install Claude Code'. Victims are served a cloned installation page and prompted to copy-paste a PowerShell command into their terminal. The command executes a dual-install technique: it silently runs a second-stage fileless PowerShell infostealer via Shell.Application COM object with window style 0 (hidden), while simultaneously installing the legitimate npm package — so the victim sees a successful installation. The PowerShell infostealer (~6,800 lines of obfuscated junk code branches) immediately patches AMSI (amsi.dll in-process patching) and suppresses ETW (PSEtwLogProvider.m_enabled flag), then loads three embedded C# assemblies via Add-Type: CredHelper (CredEnumerate from advapi32.dll for Windows Credential Manager), User32 (EnumDisplaySettings for screen fingerprinting), and Rstrtmgr (Restart Manager API for stealthy process enumeration). It collects credentials, session cookies, and configuration data from 65+ Chromium/Firefox browser profiles, Slack (Local State key and network cookies), Microsoft Teams (EBWebView partitioned cookies, DPAPI-decrypted), Discord (Local Storage LevelDB), Mattermost, Telegram Desktop (tdata directory), Zoom (DPAPI-protected win_osencrypt_key), enterprise platforms (Notion, Zoho Mail, Evernote, LiveChat), remote access tools (WinSCP registry sessions, PuTTY saved sessions, OpenVPN configs with embedded key material), cryptocurrency wallets (Brave Wallet, Spectre), and cloud storage directories (Proton Drive, iCloud Drive, Google Drive, MEGA, OneDrive). Exfiltrated data is sent to C2 endpoints at events.ms709.com (Claude campaign) and events.msft23.com (Gemini campaign) via HTTPS POST to /process, with each response returning an RSA-encrypted task list for remote code execution. No persistence mechanism was found in this vector, requiring repeated social engineering for reinfection.

The second vector, documented by Netskope Threat Labs and Huntress, targets developers and gamers with fake OpenClaw installers hosted on typosquatted GitHub repositories (openclaw-installer organization, throwaway account bgodimpulse7) and the domain openclaw-installer.com (registered March 9, 2026, behind Cloudflare). The download is a Rust-based dropper labeled 'Hologram' padded to 130MB to bypass AV file-size thresholds and sandbox upload limits. The Hologram framework delivers a six-binary modular implant: Stealth Packer C2 beacon/CLR loader (svc_service.exe), HTTPS C2 tunnel (virtnetwork.exe), reflective PE loader via NT syscall thread injection (onedrive_sync.exe, 13MB), system fingerprinter (audioeq.exe), two independent Telegram-bot droppers (WinHealhCare.exe, OneSync.exe), and the Vidar infostealer (vicloud.exe). The malware performs multi-tier anti-analysis: BIOS string and hardware profile checks, physical mouse-movement gate (execution stops without it), low-memory sandbox detection, uptime checks (minutes-old processes flagged), and a 29,000-year Sleep() call after producing artifacts to defeat timed sandboxes. It also calls ip-api.com to geolocate the victim, captures a full desktop screenshot as 24-bit BMP, and disables WinINet proxy auto-detection in the registry to bypass corporate inspection proxies. Persistence is established through three layers: Run registry autorun, WinLogon Userinit hijack, and scheduled tasks, plus independent Telegram-bot droppers that can re-infect even if primary payloads are removed. The C2 infrastructure is notably multi-layered: initially beacons via Hookdeck webhook relay (hkdk.events/djbk1i9hp0sqoh) that forwards to a Telegram channel (t.me/b8bz11 -> t.me/hgo9tx), then retrieves a manifest from an attacker-controlled Azure DevOps staging organization listing 250 targeted browser extensions (201 cryptocurrency wallets including Coinbase, MetaMask, Phantom, OKX, Rabby; 49 password managers/2FA authenticators including LastPass, 1Password, Bitwarden, Google Authenticator). Secondary C2 endpoints rotate across domains (frr.rubensbruno.adv.br -> hwd.hidayahnetwork.com, mikolirentryifosttry.info -> zkevopenanu.cfd) and use a hijacked Brazilian law firm subdomain for HTTPS beaconing. Over 30 typosquatted domains were hosted at 109.107.170.111 (MIRhosting, Netherlands). A GhostSocks backconnect proxy is also deployed on compromised machines, turning them into SOCKS5 proxies for the operator's use — a tool previously associated with BlackBasta ransomware operations. macOS users are also targeted with an Atomic macOS Stealer (AMOS) variant deployed via a curl one-liner. The campaign demonstrates coordinated multi-platform, multi-vector targeting with sophisticated evasion, dynamic C2 rotation, and abuse of legitimate cloud services (GitHub, Telegram, Azure DevOps, Hookdeck) to evade network-level blocking.

MITRE ATT&CK techniques used in TL-2026-1845

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1055 Process Injection; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1564 Hide Artifacts

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder; T1547.004 Winlogon Helper DLL

Execution

T1059.001 PowerShell; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1573 Encrypted Channel

stealth

T1218 System Binary Proxy Execution

Credential Access

T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1552.002 Credentials in Registry; T1555.003 Credentials from Web Browsers

Resource Development

T1583.001 Domains; T1608.006 SEO Poisoning

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Fake AI Developer Tool Installers Delivering Infostealer via

  • Anthropic — Claude Code
    Vulnerable versions: all versions - CLI tool is impersonated
  • Google — Gemini CLI
    Vulnerable versions: all versions - CLI tool is impersonated
  • OpenClaw — OpenClaw
    Vulnerable versions: all versions - legitimate project impersonated

Remediation for Fake AI Developer Tool Installers Delivering Infostealer via

Immediate actions

  • Block all typosquatted domains at network perimeter (see IOC list)
  • Block C2 IPs and domains: events.ms709.com, events.msft23.com, 109.107.170.111, 185.196.9.98
  • Restrict PowerShell execution policy for non-admin users (ExecutionPolicy Restricted)
  • Deploy AMSI bypass detection rules - monitor for amsi.dll in-process patching
  • Block outbound connections on ports 56001, 57001, 57002 to unknown destinations
  • Check for GhostSocks indicators: mutex c10f845f3942, scheduled task EdgeUpdateHelper
  • Scan for Run key {BackgroundTask} and WinLogon Userinit anomalies

Workarounds

  • Use official package manager repositories (npm, pip, choco) only - never install from search results
  • Disable PowerShell script execution where not required for developer workflows
  • Enforce application allowlisting to block unsigned binaries in user-writable directories
  • Use browser bookmarks for official tool installation pages instead of search

Longer-term hardening

  • Implement DNS filtering for newly registered typosquatted AI-tool domains
  • Deploy EDR with behavioral detection for fileless PowerShell and reflective PE loading
  • Monitor for Hookdeck relay traffic and Telegram API calls from non-browser processes
  • Implement application-layer inspection for Azure DevOps and Telegram API traffic
  • Deploy network monitoring for direct NT syscall injection patterns
  • Establish developer education program for verifying CLI tool installation sources
  • Deploy browser isolation for developer tool searches

Timeline of Fake AI Developer Tool Installers Delivering Infostealer via

  • Attacker GitHub accounts created (bgodimpulse7 and related threat actor accounts) - remained dormant until January 2026
  • Threat actor accounts begin spam activity on legitimate OpenClaw GitHub repository, promoting malicious repos with fake installers
  • First malicious GitHub repositories created under openclaw-installer organization. Bing AI search results poisoned to promote fake OpenClaw Windows installers
  • Huntress publishes analysis of OpenClaw GitHub GhostSocks infostealer campaign documenting malware components, multi-platform targeting (Windows + macOS), and GhostSocks backconnect proxy deployment
  • Bulk registration of typosquatted domains begins. Over 30 domains registered targeting Gemini CLI, Claude Code, Node.js, Chocolatey, KeePassXC, and Monero across TLDs including .co.com, .co.uk, .us.com, .us.org
  • openclaw-installer.com registered via Chinese/Alibaba domain registrar behind Cloudflare - hosts Hologram Rust-based dropper payloads
  • claudecode.co.com and claude-setup.com registered - cloned installation pages visually consistent with Anthropic's official documentation deployed at these domains
  • Researcher @g0njxa publicly flags the SEO poisoning campaign on X. EclecticIQ publishes comprehensive analysis of Gemini CLI and Claude Code impersonation campaign, documenting the fileless PowerShell infostealer, AMSI/ETW bypass, and C2 infrastructure at events.msft23.com and events.ms709.com
  • Infosecurity Magazine and broader security media cover the SEO poisoning campaign. Cloud Security Alliance publishes research note contextualizing the attack as part of converging trends in AI tool typosquatting and InstallFix lure distribution via search engines
  • Hologram wave 3 (Pathfinder variant v3.7.16) documented with rotated C2 infrastructure. New domains hwd.hidayahnetwork.com and zkevopenanu.cfd replace earlier C2. Campaign tags shift from #Soft0404 to #Soft0427. Vidar infostealer deployed alongside Hologram payload
  • PlanetJon publishes deep-dive analysis revealing novel C2 chain: Hookdeck webhook relay -> Telegram dead-drop channel -> Azure DevOps staging organization for extension targeting manifest (250 browser extensions). Hijacked Brazilian law firm subdomain used for HTTPS beaconing
  • Netskope publishes 'OpenClaw Trap' analysis documenting AI-assisted lure factory with 300+ delivery packages on GitHub. Two-component payload design (LuaJIT + encrypted Lua payload) with 29,000-year Sleep() evasion, geolocation preflight, and desktop screenshot exfiltration
  • Campaign infrastructure remains active. Multiple typosquatted domains still resolving. C2 domains continue to rotate with fast-flux patterns and Cloudflare proxying

Sources cited for Fake AI Developer Tool Installers Delivering Infostealer via

Detection coverage for TL-2026-1845

As of 2026-08-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1845 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
24 indicators of compromise · Red and above. Compare plans

Community OSINT corroboration for TL-2026-1845

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats