OpenClaw Malware Targets Crypto Wallets and Bitwarden Credentials

OpenClaw users are being targeted in a fresh malware campaign that abuses a fake installer to steal credentials from popular crypto wallets and password managers, including MetaMask, Phantom, and Bitwarden.

The archive contains a 130MB Rust executable padded with fake documentation to evade antivirus file-size scanning limits and many automated sandbox upload thresholds.

The PE manifest does not try to hide its purpose, openly naming the binary “Hologram” with the description “Decoy entity generator for tactical misdirection.”

Netskope Threat Labs uncovered a malicious website, openclaw-installer[.]com, that impersonates the legitimate OpenClaw project and offers a Windows installer called OpenClaw_x64.7z.

Once launched, the installer presents a convincing GUI and UAC prompt while silently running a multi-layer anti-VM routine that checks BIOS strings, VM artifacts, hardware profile, and even waits for real mouse movement before executing malicious code, allowing it to slip past many automated sandboxes.

OpenClaw Malware

After the checks, Hologram decodes and runs an obfuscated PowerShell payload that disables Microsoft Defender, adds multiple exclusion paths, and opens inbound firewall ports that will later be reused by the stage‑2 framework.

It then pulls a password-protected archive and additional modules from the attacker infrastructure, drops six binaries into the public and user folders, and checks in to a Telegram channel via a Hookdeck relay, sending the victim’s username, public IP, and timestamp.

The second stage is a modular “Stealth Packer” framework made up of six Rust-based components that coordinate persistence, C2, and in-memory execution. Hologram is dropper-delivered via a fake OpenClaw installer, undetected by automated sandboxes. 

One module fingerprints the system to decide whether the victim merits the full implant, another beacons rapidly to a hijacked Brazilian law-firm subdomain over HTTPS, while others establish Telegram-based persistence and run additional payloads entirely from memory using custom loaders.

A standout capability is the use of the Rust crate clroxide to host the .NET CLR inside a native Rust process, enabling an embedded .NET assembly to execute fully in memory without touching disk tradecraft more typical of red-team tools than commodity crimeware.

Another module uses a custom “entropy reducer” loader to decrypt and reflectively execute a PE via direct NT syscalls, bypassing user‑mode EDR hooks that monitor ntdll.

The archive password is retrieved from a dead-drop URL with a primary and fallback; the password-protected 7z payload downloads from C2; a separate Ledger Live module is fetched from a distinct URL.

Persistence is layered and resilient: the framework sets a Run key, hijacks the WinLogon Userinit value so its code runs before userinit.exe, creates a privileged scheduled task, and uses independent Telegram-based droppers that can re-establish the implant even if core components are removed.

This depth makes remediation significantly harder on unmanaged or lightly monitored endpoints.

MetaMask, Phantom, Bitwarden targeted

The real objective emerges in the extension targeting logic. During stage 2, the malware fetches a plaintext “manifest” file from an attacker-controlled Azure DevOps organization, disguised as a .7z archive but actually listing 250 browser extensions for credential theft.

This list covers 201 crypto wallet extensions, including MetaMask, Phantom, Coinbase, OKX, Rabby, and Ronin, along with 49 password managers and 2FA tools such as Bitwarden, LastPass, 1Password, NordPass, KeePass, Dashlane, and Google Authenticator.

Because the manifest is server-side rather than hardcoded, the operator can update targeted wallet and password manager extensions without recompiling any binary, giving the campaign a flexible and long-lived theft surface.

In parallel, a separate Ledger Live–focused module provides a second, independent path to steal crypto assets, further increasing the impact on high-value victims.

The operators lean heavily on legitimate cloud services for command-and-control and configuration delivery. Telegram is used as a dead‑drop to advertise primary C2 domains inside public channel descriptions, while a Hookdeck webhook relay ensures the Telegram bot token and backend infrastructure never appear directly in network traffic.

Primary C2 runs on compromised or repurposed domains, including a hijacked Brazilian law-firm subdomain, with secondary endpoints and password pastes rotated frequently via snippet.host and Pastebin.

Netskope notes that this is the first documented crimeware campaign to use Hookdeck as a C2 relay, and that the operator rotated infrastructure mid‑analysis without recompiling the framework, underscoring both maturity and active maintenance of the toolset.

For defenders, that means IP‑only perimeter controls are insufficient; inspection of application‑layer traffic to services like Telegram, Azure DevOps, and Hookdeck is now critical to detecting similar campaigns.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.