SEO-poisoned AI installer campaign targets developer workstations
SEO-poisoned AI installer campaign targets developer workstations
Threat actors are pushing fake Gemini CLI and Claude Code install pages through search manipulation, using typosquatted domains that mimic official documentation. Victims are told to run a one-line PowerShell command that installs the real package while silently loading a fileless infostealer in memory. Eclecticiq linked the campaign to over 30 related domains tied to the same infrastructure.
The tradecraft is notable for blending legitimate npm installation output with ETW suppression, AMSI bypass, in-memory execution, and theft of browser sessions, messaging app tokens, remote access credentials, and cloud data. Targeting developers raises the impact from single-host compromise to wider enterprise and supply-chain exposure.
️ Open sources - closed narratives
Source: Telegram "sitreports"