Multi-Stage SEO Poisoning Campaign Delivers Pterodo (Windows) and AMOS (macOS) via Cloudflare Workers/Pages and ClickFix — Fake Claude Code / NotebookLM Installers — Threadlinqs Intelligence
As of 2026-05-30, Multi-Stage SEO Poisoning Campaign Delivers Pterodo (Windows) and AMOS (macOS) via Cloudflare Workers/Pages and ClickFix — Fake Claude Code / NotebookLM Installers is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 43 indicators of compromise.
Threat ID: TL-2026-0507 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Active cross-platform malware delivery campaign poisons sponsored search results for 'Claude Code' and 'NotebookLM download', funnels victims through phishing pages on Squarespace, Tilkly, and
Threadlinqs Intelligence is tracking an active multi-stage malware distribution operation publicly analyzed by Ireneusz Tarnowski on 2026-05-03 (Medium) and cataloged by Malpedia the same day. The campaign weaponizes the popularity of AI developer tooling — specifically Anthropic's Claude Code CLI and Google's NotebookLM — by purchasing sponsored search placements and SEO-poisoning organic results for 'Claude Code' and 'NotebookLM download'. Victims who click are funneled through phishing landing pages hosted on legitimate, high-reputation SaaS platforms (Squarespace, Tilkly, Bitbucket Pages, plus an iina-technical[.]com lookalike) that are unlikely to be blocked by category-based web filtering.
The initial landing pages do not host the malware directly. Instead they present a ClickFix social-engineering modal driven by an install-modal.js script and, in earlier variants, a connector_bg.wasm WebAssembly module with access to fetch, localStorage, navigator.userAgent and crypto APIs. The modal displays platform-specific instructions and silently writes a command to the system clipboard, telling the user to open Terminal (macOS) or Run/cmd.exe (Windows) and paste-execute it. Late variants embed the command directly in code rather than retrieving it from a C2 first — a deliberate simplification observed by Tarnowski as the operators reacted to defensive pressure.
The pasted command pulls a stage-two loader from a Cloudflare Workers or Pages subdomain (workers.dev / pages.dev). The Cloudflare staging node performs User-Agent fingerprinting, returning the Windows polyglot only to Windows browsers and the macOS Mach-O only to macOS browsers; non-matching User-Agents receive decoys or 404s. This per-victim routing is a hallmark of the campaign and frustrates retroactive analysis.
Windows path — claude.mp3 polyglot: The downloaded file (SHA-256 1df4207e9ad772c0ef96e35a2756626b4af5065f1296bfb7b0520695d4200350) is a true polyglot — valid MP3 metadata that also contains a hidden VBA script. Execution is triggered through a cmd.exe one-liner that splits the word 'powershell' via environment variables to evade naive command-line detections: cmd /v:on /c "set x=pow&&set y=ershell&&call %windir%\SysWOW64\WindowsPowerShell\v1.0\!x!!y! -E <base64>". The decoded PowerShell stage generates a victim identifier (MD5 of hostname + username), disables TLS certificate validation, implements a custom RC4-variant decoder, performs in-memory AMSI bypass by patching AmsiScanBuffer, then pulls and IEX-executes the final Pterodo RAT payload entirely in memory (fileless). Pterodo is historically associated with Gamaredon Group / Primitive Bear (Russia, FSB-linked) but the source analysis explicitly defers attribution.
macOS path — helper Mach-O Universal Binary: The downloaded file (SHA-256 c8fd1222c3f70f91c401b008711629bf053874dfec315a48758a032acd114b1a) is a fat Mach-O containing both x86_64 and arm64 slices to cover Intel and Apple Silicon Macs. Invocation uses a curl one-liner with tr-based character-translation obfuscation. Earlier variants exfiltrated through api.telegram.org via a hard-coded bot token (bot6529184364:AAEdwM7o7w1Z5XJxQf5H2tHkVfV1mX2QeQ); newer variants use dedicated HTTP infrastructure on dpsmuz[.]com and a DGA pattern on oakenfjrod[.]ru (subdomain = MD5(victim_id)), with requests validated by a custom X-R: 4f2j0n header. The helper reconstructs AMOS in memory from 37 chunks embedded in the __TEXT.__const and __DATA_CONST.__const Mach-O segments; encryption keys are rebuilt from dedicated fragments using XOR with constants 0x34 and 0x8e, and a custom Base64 decoder with 6-bit symbol mapping. Once reconstructed, AMOS harvests Chrome and Firefox cookies/logins/form-data, cryptocurrency wallets (Exodus, Electrum, Atomic, Wasabi), Telegram tdata, the macOS Keychain, iCloud account data, and Desktop/Documents files. It uses dscl . authonly to validate user credentials non-privileged (avoiding sudo prompts) and repeatedly prompts the user
Target sectors: technology, software-development, ai-research, financial, cryptocurrency, media, general
Target regions: North America, Europe, Asia-Pacific, Latin America
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 43 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1608, T1189, T1566, T1204, T1059, T1543, T1027, T1140, T1685
