Hackers are increasingly abusing search engine optimization (SEO) techniques to distribute malware by impersonating popular AI developer tools, including Gemini CLI and Claude Code.
The activity, first observed in early March 2026, shows attackers creating malicious domains that rank above legitimate sources in search engine results.
Developers searching for official installation guides are redirected to these fake websites, which closely mimic real documentation from trusted vendors. Once on the page, victims are instructed to copy and execute a PowerShell command to install the tool, unknowingly triggering a hidden malware infection.
In one observed case, users searching for Gemini CLI were redirected to a typosquatted domain, geminicli[.]co[.]com. The site displayed what appeared to be legitimate installation instructions, prompting users to execute a command that silently fetched a malicious PowerShell script from gemini-setup[.]com.
This script downloaded and executed an infostealer entirely in memory, leaving minimal forensic evidence on disk.
The malware establishes communication with command-and-control infrastructure such as events[.]msft23[.]com, where stolen data is exfiltrated in encrypted form.
A recent campaign uncovered by EclecticIQ highlights how financially motivated threat actors are targeting software developers by poisoning search results and delivering fileless infostealer malware through convincing fake installation pages.
A parallel campaign targeting Anthropic’s Claude Code used similar infrastructure and techniques, including domains like claudecode[.]co[.]com and claude-setup[.]com, indicating a likely single threat actor behind both operations.
What makes this campaign particularly deceptive is its dual execution method. While the malicious script runs in the background, it simultaneously installs the legitimate Gemini CLI via npm.
This creates the illusion of a successful installation, masking the compromise. By the time the user begins interacting with the tool, sensitive data has already been harvested and transmitted to attacker-controlled servers.
Pivoted cluster is nodejs-setup.co[.]com, a domain impersonating the official Node.js installation page. Rather than delivering a legitimate Node.js installer, the page instructs the visitor to execute the following PowerShell command.
The infostealer is designed to evade detection and operate stealthily. It disables key Windows security features such as Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI), effectively blinding endpoint defenses.
The payload is heavily obfuscated and executes entirely in memory using PowerShell, making it difficult for traditional security tools to detect.
Once active, the malware collects a wide range of sensitive data from infected systems. This includes browser credentials, session cookies, OAuth tokens, VPN configurations, SSH keys, and data from collaboration tools such as Slack, Microsoft Teams, Discord, and Zoom.
It also targets cloud storage directories, cryptocurrency wallets, and local files, providing attackers with extensive access to both personal and enterprise environments.
Notably, the malware includes functionality for remote code execution, allowing attackers to issue commands and deploy additional payloads on compromised systems. This enables a shift from automated data theft to interactive, hands-on-keyboard attacks, increasing the risk of deeper network compromise.
Infrastructure analysis revealed that the campaign is hosted on bulletproof hosting services and includes more than 30 related domains impersonating developer tools such as Node.js, Chocolatey, and KeePassXC.
In one variation, attackers used a fake Node.js installation page that chained multiple spoofed domains to deliver the same infostealer payload, further enhancing credibility.
The campaign demonstrates how threat actors are leveraging the growing adoption of AI tools in enterprise environments to exploit developer trust. Developers often operate with elevated privileges and access to critical systems, making them high-value targets for initial access.
Despite recent law enforcement actions against major infostealer operations such as RedLine and LummaC2, this campaign underscores the استمرار and evolution of credential theft ecosystems. Low operational costs and high demand for stolen data continue to fuel these attacks.
Security teams are advised to monitor for suspicious PowerShell activity, particularly the use of commands like Invoke-RestMethod and Invoke-Expression chained together. Additional indicators include hidden PowerShell execution, unusual outbound connections shortly after script execution, and traffic to suspicious domains mimicking legitimate developer tools.
This campaign reinforces the importance of verifying software sources, especially when installing developer tools, and highlights the growing intersection between AI adoption and supply chain risk in modern enterprise environments.
| # | Domain |
|---|---|
| 1 | api.bio9438.com |
| 2 | claudecode-install.co.com |
| 3 | openclow.co.com |
| 4 | geninicli.co.com |
| 5 | keepassxc.us.org |
| 6 | claude-code.co.com |
| 7 | chocolatey.net |
| 8 | claudecode.co.com |
| 9 | chocolatey-setup.co.com |
| 10 | get-monero.co.uk |
| 11 | getmonero.us.com |
| 12 | metrics.msft17.com |
| 13 | claude-setup.com |
| 14 | keepassxc.us.com |
| 15 | olive3451.com |
| 16 | events.ms709.com |
| 17 | chocolatey-download.co.com |
| 18 | chocolatey.co.com |
| # | SHA-256 Hash |
|---|---|
| 1 | ff81cb9263fcde5870a0748fd6af2d30a4ba864415c15ca14827d0dd723eb60c |
| 2 | 9c87e8162b39fbb773c416006b16f8e34aca53372d1b2d4a584df0ffc69ad333 |
| 3 | 89d634c8471382ff9c6fd966008ad5c376d7a0edae8f799eb569837170f2373d |
| 4 | be2ff065a232a3a6f187f9fb03a6c1b368dff3d2ba0966777b1f5503aa5ecd16 |
| 5 | a1c5e1d9bdc1a931c11ac6fdfdff1fbc69ff88521cf443cb174f9720a05fe72d |
| 6 | bb78f024c4d8b5a6a128aacb498acad025a234a6b25fde36ff2e14601134555f |
| 7 | a6525b37b0cc5339df375e17a0c10772b50c9d425001b0c3a9dada995c7f62dd |
| 8 | b37ee243518221017bab0eb4b54b5431571cc21e54113698ce49a89b89993754 |
| 9 | aa350580ae5ea46544ffa15c324ab4225dff0dcc5842ac5ca8e2dc4018e5ffad |
| 10 | 65e1a542bb7d995cc4aa6c71191da125f14f99ca03da7266f5b071440d6d229a |
| 11 | 64d2a9a49e27d89f1b3489d7db29c3a3a12b4b090f59c24b694c239cb55db262 |
| 12 | 2d7a94e4a0fedcf31cdd43b06222add9d1888fecb2c5488afc658d08c3f40116 |
| 13 | 5c6a2c73f59fd8defbf118f87e5c88ba62e3067f8e8c0ed104f3f188fa0d959d |
| 14 | de34f2f93b74e049a08074c779a863a87a85a403594b8e220b1fba15112e6386 |
| 15 | 0e8c45d847f57095d9879c0da764ab02431db4d5d85f50c4fd5ba38353b79eed |
| 16 | dfd21a363f4994794f821d76ca61c834882a51b5c6f7b95627b70789462149e3 |
| 17 | a31ae1eef3261c36b465255e624fb7ac5899bf2a9823564ba792fac8346723aa |
| 18 | 1439d30ebeac3a6ccb9545acaa350783a83cc08746cb575e59ddb0efc77d412a |
| 19 | 7c2a9ad5fcf489d1844f51830242f6dd9dfc203be6de3ceb07a4f6dd21c9f1a3 |
| 20 | 80ffc86673bd8c8bd5862bbe961323a822b23c94df48c685162c571445552faa |
| 21 | c416052c8ac6bfb78b7f0c46c568c528ead33501149661f1d9ecb1861269f8fa |
| 22 | efbf87447d93f4232b1169920f75c2066d19863ebc28fb2d2662353dc4ef61d8 |
| 23 | 2d9ecc9321994558d0cc0e9d3fa9fdf600bacfe8758976d34f26f89c33bd5007 |
| 24 | ae9bc11adb457930d402844bd3bf3af8ea7c13fdb7ea269fbe73877b18af1ca8 |
| 25 | c213ce07b5791abd334ff749b5f05ecc6b40772d35ef4388b5f576bc3e619765 |
| 26 | 27e17661f5573f63b65e3a5cfe5bdca75acdc1911441b032781f7ebe125d9194 |
| 27 | ae8f70dad97fedecd707977ca22fd6f656c64c0dac96e03f0f4a6c04d0693f59 |
| 28 | c47610c9df3fb101b0e99f2ac12589db653464edf12cebaa2c67fd33fc7715f3 |
| 29 | 5071921cb1ca369fe8f7af522a00373c8c85e4357f7ea1879d2cb4ae791797d6 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…