Hackers Use Fake OpenClaw Installer to Steal Crypto Wallet and Password Manager Credentials

A sophisticated infostealer campaign masquerades as an OpenClaw installer (OpenClaw_x64.7z) containing a large Rust executable padded to evade sandboxes; once executed it performs VM/sandbox checks, waits for real user input, disables Defender, and downloads six modular components that harvest credentials from over 250 browser extensions (including many crypto wallets and password managers), fingerprint systems, maintain layered persistence, and use rotating infrastructure (Telegram dead-drops, Hookdeck relay, Azure DevOps staging) to evade takedown; the report includes numerous file hashes, domains, IPs, mutexes, registry persistence keys, and staging URLs as IoCs.