A sophisticated SEO poisoning campaign targets users searching for DeepSeek AI tools by using malicious lookalike domains on first-page search results. The attack uses a multi-stage infection chain starting with weaponized MSI files disguised as legitimate DeepSeek software, progressing through shellcode execution and DLL side-loading via legitimate Cyglaunch software, and culminating in the deployment of Kong RAT. The final payload includes keylogger functionality and persistence through registry modifications. Attribution suggests a Chinese threat actor linked to previous campaigns targeting Chinese developer tools.