# Fake AI Developer Tool Installers Delivering Infostealer via SEO Poisoning and Typosquatting

> A financially motivated eCrime campaign targeting software developers with fake installers impersonating Claude Code, Google Gemini CLI, and the OpenClaw project. SEO-poisoned search results and typosquatted domains deliver a fileless PowerShell infostealer (Gemini/Claude impersonation) and a Rust-based six-module implant framework called Hologram (OpenClaw impersonation) that steal credentials, session cookies, crypto wallet data, and CI/CD secrets.

- **Published:** 2026-08-03T00:00:00Z
- **Last reviewed:** 2026-08-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1845
- **ID:** TL-2026-1845
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This campaign encompasses two highly correlated attack vectors — both leveraging typosquatting and social engineering to deliver infostealer malware to developer workstations. The first vector, documented by EclecticIQ and Infosecurity Magazine, uses SEO poisoning to place typosquatted domains such as 'geminicli.co.com' and 'claudecode.co.com' above legitimate search results for 'install Gemini CLI' and 'install Claude Code'. Victims are served a cloned installation page and prompted to copy-paste a PowerShell command into their terminal. The command executes a dual-install technique: it silently runs a second-stage fileless PowerShell infostealer via Shell.Application COM object with window style 0 (hidden), while simultaneously installing the legitimate npm package — so the victim sees a successful installation. The PowerShell infostealer (~6,800 lines of obfuscated junk code branches) immediately patches AMSI (amsi.dll in-process patching) and suppresses ETW (PSEtwLogProvider.m_enabled flag), then loads three embedded C# assemblies via Add-Type: CredHelper (CredEnumerate from advapi32.dll for Windows Credential Manager), User32 (EnumDisplaySettings for screen fingerprinting), and Rstrtmgr (Restart Manager API for stealthy process enumeration). It collects credentials, session cookies, and configuration data from 65+ Chromium/Firefox browser profiles, Slack (Local State key and network cookies), Microsoft Teams (EBWebView partitioned cookies, DPAPI-decrypted), Discord (Local Storage LevelDB), Mattermost, Telegram Desktop (tdata directory), Zoom (DPAPI-protected win_osencrypt_key), enterprise platforms (Notion, Zoho Mail, Evernote, LiveChat), remote access tools (WinSCP registry sessions, PuTTY saved sessions, OpenVPN configs with embedded key material), cryptocurrency wallets (Brave Wallet, Spectre), and cloud storage directories (Proton Drive, iCloud Drive, Google Drive, MEGA, OneDrive). Exfiltrated data is sent to C2 endpoints at events.ms709.com (Claude campaign) and events.msft23.com (Gemini campaign) via HTTPS POST to /process, with each response returning an RSA-encrypted task list for remote code execution. No persistence mechanism was found in this vector, requiring repeated social engineering for reinfection.

The second vector, documented by Netskope Threat Labs and Huntress, targets developers and gamers with fake OpenClaw installers hosted on typosquatted GitHub repositories (openclaw-installer organization, throwaway account bgodimpulse7) and the domain openclaw-installer.com (registered March 9, 2026, behind Cloudflare). The download is a Rust-based dropper labeled 'Hologram' padded to 130MB to bypass AV file-size thresholds and sandbox upload limits. The Hologram framework delivers a six-binary modular implant: Stealth Packer C2 beacon/CLR loader (svc_service.exe), HTTPS C2 tunnel (virtnetwork.exe), reflective PE loader via NT syscall thread injection (onedrive_sync.exe, 13MB), system fingerprinter (audioeq.exe), two independent Telegram-bot droppers (WinHealhCare.exe, OneSync.exe), and the Vidar infostealer (vicloud.exe). The malware performs multi-tier anti-analysis: BIOS string and hardware profile checks, physical mouse-movement gate (execution stops without it), low-memory sandbox detection, uptime checks (minutes-old processes flagged), and a 29,000-year Sleep() call after producing artifacts to defeat timed sandboxes. It also calls ip-api.com to geolocate the victim, captures a full desktop screenshot as 24-bit BMP, and disables WinINet proxy auto-detection in the registry to bypass corporate inspection proxies. Persistence is established through three layers: Run registry autorun, WinLogon Userinit hijack, and scheduled tasks, plus independent Telegram-bot droppers that can re-infect even if primary payloads are removed. The C2 infrastructure is notably multi-layered: initially beacons via Hookdeck webhook relay (hkdk.events/djbk1i9hp0sqoh) that forwards to a Telegram channel (t.me/b8bz11 -> t.me/hgo9tx), then retrieves a manifest from an attacker-controlled Azure DevOps staging organization listing 250 targeted browser extensions (201 cryptocurrency wallets including Coinbase, MetaMask, Phantom, OKX, Rabby; 49 password managers/2FA authenticators including LastPass, 1Password, Bitwarden, Google Authenticator). Secondary C2 endpoints rotate across domains (frr.rubensbruno.adv.br -> hwd.hidayahnetwork.com, mikolirentryifosttry.info -> zkevopenanu.cfd) and use a hijacked Brazilian law firm subdomain for HTTPS beaconing. Over 30 typosquatted domains were hosted at 109.107.170.111 (MIRhosting, Netherlands). A GhostSocks backconnect proxy is also deployed on compromised machines, turning them into SOCKS5 proxies for the operator's use — a tool previously associated with BlackBasta ransomware operations. macOS users are also targeted with an Atomic macOS Stealer (AMOS) variant deployed via a curl one-liner. The campaign demonstrates coordinated multi-platform, multi-vector targeting with sophisticated evasion, dynamic C2 rotation, and abuse of legitimate cloud services (GitHub, Telegram, Azure DevOps, Hookdeck) to evade network-level blocking.

## MITRE ATT&CK

- T1059.001 PowerShell
- T1204.002 Malicious File
- T1218 System Binary Proxy Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1547.004 Winlogon Helper DLL
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1497.001 System Checks
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1564 Hide Artifacts
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1552.002 Credentials in Registry
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1573 Encrypted Channel
- T1090 Proxy
- T1583.001 Domains
- T1608.006 SEO Poisoning

## Sources

- [Developers in the Crosshairs: Fake AI Tools Deliver Infostealer](https://www.netskope.com/blog/developers-in-the-crosshairs-fake-ai-tools-deliver-infostealer)
- [OpenClaw's Hologram: Fake Installer Ships Rust Infostealer](https://www.netskope.com/blog/openclaw-hologram-fake-installer-ships-rust-infostealer)
- [OpenClaw Trap: AI-Assisted Lure Factory Targets Developers & Gamers](https://www.netskope.com/blog/openclaw-trap-ai-assisted-lure-factory-targets-developers-gamers)
- [SEO Poisoning Campaign Leverages Gemini and Claude Code Impersonation to Deliver Infostealer](https://blog.eclecticiq.com/seo-poisoning-campaign-leverages-gemini-and-claude-code-impersonation-to-deliver-infostealer)
- [Fake Gemini/Claude Sites Spread Infostealers via SEO Poisoning](https://www.infosecurity-magazine.com/news/gemini-claude-infostealers-seo/)
- [OpenClaw GitHub GhostSocks Infostealer](https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer)
- [OpenClaw Campaign Delivers Rust-Based Hologram Infostealer](https://advisory.eventussecurity.com/advisory/openclaw-campaign-delivers-rust-based-hologram-infostealer/)
- [Weaponizing the Cloud: How the OpenClaw Hologram Campaign Uses Telegram, Azure DevOps, and Hookdeck for C2](https://www.planetjon.net/news/cybersecurity/weaponizing-the-cloud-how-the-openclaw-targeting-hologram-campaign-uses-telegram-azure-devops-and-hookdeck-for-c2/)
- [CSA Research Note: AI Tool Impersonation, InstallFix, and Typosquatting](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-tool-impersonation-installfix-typosquat/)
- [Netskope Threat Labs IOCs Repository](https://github.com/netskopeoss/NetskopeThreatLabsIOCs)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1845