Hackers Target PuTTY Users With SEO Poisoning and Ethereum-Powered Malware

A search for PuTTY can lead to more than a fake download. In a campaign reported on October 12, attackers used search-engine optimization (SEO) poisoning to steer users to a counterfeit PuTTY site and deliver a trojanized Windows installer.

The campaign targets people searching Google for “PuTTY” or “PuTTY download.” A high-ranking result leads to a spoofed page, observed at puty.ink, whose title imitates PuTTY’s legitimate download page.

Its download link delivers a file named Putty-x86_64.msi from third-party cloud storage.

When run, the installer places four files in a user’s local application-data directory. One is an unmodified, Sectigo-signed copy of PuTTY 0.85; the others form the malicious loader chain.

The real PuTTY interface opens, giving the victim a working SSH client and a convincing reason to believe the installation succeeded. Meanwhile, the installer runs the malware in the background.

The first stage is a batch script that hides its console and checks for Node.js. If it finds no installation, it downloads the legitimate Node.js 18.20.5 runtime from nodejs.org.

A short JScript trampoline then launches an obfuscated JavaScript payload through that runtime.

This “bring your own interpreter” approach relies on legitimate software to execute the malicious code, complicating detection based on suspicious executable files alone.

Rather than relying only on a fixed server address, the malware queries an Ethereum mainnet smart contract using JSON-RPC eth_call requests.

It contacts seven public RPC endpoints and selects the URL most frequently returned. The loader checks for a valid HTTP, HTTPS or WebSocket URL and refreshes the result every five minutes; a hardcoded fallback is also present.

This use of blockchain as a C2 address book is known as EtherHiding. It lets operators change the server address without replacing the malware already on victims’ computers.

The technique does not make the malware or its traffic invisible: endpoints, network requests and contract interactions may still provide investigative leads.

But it can make disruption harder when defenders focus only on a conventional, hardcoded C2 domain.

Unit42 Researchers said that, the installer launched a genuine, signed PuTTY application as a decoy while silently setting up a Node.js-based malware loader.

Ethereum-Powered Malware

Earlier reporting has documented EtherHiding as a way to retrieve malicious infrastructure or code through smart contracts.

Once connected, the loader polls the C2 server every 500 milliseconds, disguising requests as fetches for static files such as images or stylesheets.

Palo Alto Researchers identified that, the loader retrieves its command-and-control (C2) address through an Ethereum smart contract, then allows operators to send new JavaScript capabilities to infected systems.

Responses larger than 10 bytes are executed as JavaScript with access to Node.js functionality. This gives operators a flexible remote-execution channel: they can push additional capabilities without reinstalling the initial payload.

Observed commands collected system details including Windows version, locale, graphics hardware, antivirus products, domain membership and SMB sessions.

The malware also exfiltrated browser profiles and session cookies, with reported transfers reaching hundreds of megabytes.

Operators installed a WebSocket package and ran a PowerShell loop that captured roughly five desktop screenshots per second, enabling near-live monitoring of a victim’s activity.

The reported infection path does not establish who operated the campaign or how many systems were compromised.

The described capabilities nevertheless create serious risk, especially for technical users who may use PuTTY to access internal servers shortly after installation.

Download PuTTY from its official project page, not a search advertisement or unfamiliar mirror, and verify the installer’s signature and source.

PuTTY’s official release page lists version 0.85 and its signed 64-bit installer. Organizations should investigate unexpected Node.js runtimes in user-profile directories, suspicious msiexec.exe-to-cmd.exe activity and hidden wscript.exe launches.

If a suspected installer has run, isolate the host, investigate browser-session exposure, and rotate credentials and tokens that may have been accessible from that system.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.