dlsym() with the RTLD_NEXT flag basically:
https://catonmat.net/simple-ld-preload-tutorial-part-two
There's actually a better way to hook GNUs malloc:
https://www.man7.org/linux/man-pages/man3/malloc_hook.3.html
This is better because you can disable the hook inside the callback, and therefore use malloc within your malloc hook (no recursion)
But you can't use this mechanism before main()