SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks

A sophisticated SEO poisoning campaign targets users searching for DeepSeek AI tools by using malicious lookalike domains on first-page search results. The attack uses a multi-stage infection chain starting with weaponized MSI files disguised as legitimate DeepSeek software, progressing through shellcode execution and DLL side-loading via legitimate Cyglaunch software, and culminating in the deployment of Kong RAT. The final payload includes keylogger functionality and persistence through registry modifications. Attribution suggests a Chinese threat actor linked to previous campaigns targeting Chinese developer tools.

• August 2026 Infostealer Trend ReportMalware2026-09-22
• June 2026 Infostealer Trend ReportMalware2026-07-15
• September 2026 Infostealer Trend ReportMalware2026-10-28
• Tricks from the Past deployed via signed ChatGPT and Claude binariesMalware2026-10-27
• "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesCampaign2026-10-21