Excerpt
Netskope Threat Labs has found a fake OpenClaw installer delivering red-team-grade capabilities—all pointed at stealing credentials from over 250 crypto wallet and password manager extensions. The dropper’s manifest doesn’t hide the intent:
“Hologram – Decoy entity generator for tactical misdirection.”
Summary
Hologram is dropper-delivered via a fake OpenClaw installer, undetected by automated sandboxes. The operator abuses Azure DevOps, Telegram, and Hookdeck as infrastructure—legitimate services inside most enterprise allowlists.
While Huntress documented the first wave in February1, this post covers the second wave: six-binary modular implant f…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Netskope on netskope.com.
Mentioned in the excerpt
More from Netskope3
- $100k in Crypto Drained by the Underground OperationNetskope · Published 1 Oct
- Shai-Hulud 2.0: Aggressive, Automated, and Fast SpreadingNetskope · Published 26 Nov 2025
- New Phishing Attacks Exploiting OAuth Authorization Flows (Part 1)Netskope · Published 10 Aug 2021
On the same topics
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent DataGen Digital · Published 8 Oct
- Unmasking a Multi-Stage Loader: AutoIt Abuse Leading to Vidar Stealer Command-and-Control CommunicationLevelBlue · Published 7 May
