Tactical Misdirection: The “Hologram” Malware Framework Hijacking AI Enthusiasts

Netskope Threat Labs uncovered a sophisticated multi-wave campaign (Hologram → Pathfinder) that has progressed from simple credential stealers to a modular infostealer framework targeting over 250 crypto wallet and password-manager extensions. The operators employ advanced evasion and persistence techniques (CLR injection, reflective PE loading, NT syscall thread injection, WinLogon/COM hijacking), abuse legitimate services for payload hosting and C2 (Azure DevOps, Telegram, Hookdeck), and deployed stage-2 binaries including vicloud.exe (Vidar) and an emerging dbau.exe while rotating infrastructure to evade detection.