SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer

This ongoing infostealer campaign targets software developers through SEO poisoning by impersonating AI platforms such as Gemini CLI and Claude Code, and developer tools like Node.js, Chocolatey, and KeePassXC. Attackers register numerous typosquatted domains and manipulate search engine results to direct victims to malicious installation pages. The delivered malware is a fileless PowerShell-based infostealer that executes in memory, disables Windows Defender telemetry by patching ETW and AMSI, and harvests sensitive credentials including OAuth tokens, CI/CD credentials, and VPN details. These stolen credentials provide attackers with direct access to enterprise networks. The campaign infrastructure includes bulletproof hosting and focuses on users in the US and UK. There is no indication of a software vulnerability or exploit; rather, the threat relies on social engineering and malware delivery techniques.

The campaign results in credential theft from targeted developers, including OAuth tokens, CI/CD credentials, and corporate VPN information. This enables attackers to gain unauthorized access to enterprise networks, potentially leading to further compromise or data exfiltration. The malware evades detection by executing filelessly and disabling Windows Defender telemetry, increasing the difficulty of detection and response.

As this campaign relies on SEO poisoning and social engineering rather than a software vulnerability, no patches or official fixes exist. Organizations should educate developers about the risks of downloading software from untrusted or suspicious domains, verify URLs carefully, and use endpoint protection solutions capable of detecting fileless malware and PowerShell abuse. Monitoring for typosquatted domains and blocking access to known malicious domains can help reduce risk. Since no vendor advisory or patch is available, patch status is not applicable.