Multi-Stage SEO Poisoning Campaign Delivers Pterodo (Windows) and AMOS (macOS) via Cloudflare Workers/Pages and ClickFix — Fake Claude Code / NotebookLM Installers
Multi-Stage SEO Poisoning Campaign Delivers Pterodo (TL-2026-0507), also tracked as Claude Code Installer Lure Campaign, is a high-severity malware campaign, first published 2026-05-13. It has no confirmed attribution, affects Microsoft Windows, maps to 22 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 43 indicators of compromise.
Key facts for TL-2026-0507
- Threat ID
- TL-2026-0507
- Also known as
- Claude Code Installer Lure Campaign, NotebookLM SEO Poisoning Campaign, ClickFix AMOS / Pterodo Campaign (Tarnowski 2026-05-03)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-13
- Last reviewed
- 2026-05-13
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, ai-research, financial, cryptocurrency, media, general
- Target regions
- North America, Europe, Asia-Pacific, Latin America
- Detection rules
- 9
- Indicators of compromise
- 43
Malware and tooling in Multi-Stage SEO Poisoning Campaign Delivers Pterodo
Malware and tooling: AMOS, Pteranodon - S0147
Active cross-platform malware delivery campaign poisons sponsored search results for 'Claude Code' and 'NotebookLM download', funnels victims through phishing pages on Squarespace, Tilkly, and Bitbucket Pages, then uses ClickFix social engineering to land Pterodo RAT on Windows (via a polyglot MP3/VBA claude.mp3) and AMOS (Atomic macOS Stealer) on macOS (via a Mach-O Universal Binary helper loader). Late-stage staging hides on Cloudflare workers.dev and pages.dev subdomains to blend with legitimate SaaS traffic.
How Multi-Stage SEO Poisoning Campaign Delivers Pterodo works
Threadlinqs Intelligence is tracking an active multi-stage malware distribution operation publicly analyzed by Ireneusz Tarnowski on 2026-05-03 (Medium) and cataloged by Malpedia the same day. The campaign weaponizes the popularity of AI developer tooling — specifically Anthropic's Claude Code CLI and Google's NotebookLM — by purchasing sponsored search placements and SEO-poisoning organic results for 'Claude Code' and 'NotebookLM download'. Victims who click are funneled through phishing landing pages hosted on legitimate, high-reputation SaaS platforms (Squarespace, Tilkly, Bitbucket Pages, plus an iina-technical[.]com lookalike) that are unlikely to be blocked by category-based web filtering.
The initial landing pages do not host the malware directly. Instead they present a ClickFix social-engineering modal driven by an install-modal.js script and, in earlier variants, a connector_bg.wasm WebAssembly module with access to fetch, localStorage, navigator.userAgent and crypto APIs. The modal displays platform-specific instructions and silently writes a command to the system clipboard, telling the user to open Terminal (macOS) or Run/cmd.exe (Windows) and paste-execute it. Late variants embed the command directly in code rather than retrieving it from a C2 first — a deliberate simplification observed by Tarnowski as the operators reacted to defensive pressure.
The pasted command pulls a stage-two loader from a Cloudflare Workers or Pages subdomain (workers.dev / pages.dev). The Cloudflare staging node performs User-Agent fingerprinting, returning the Windows polyglot only to Windows browsers and the macOS Mach-O only to macOS browsers; non-matching User-Agents receive decoys or 404s. This per-victim routing is a hallmark of the campaign and frustrates retroactive analysis.
Windows path — claude.mp3 polyglot: The downloaded file (SHA-256 1df4207e9ad772c0ef96e35a2756626b4af5065f1296bfb7b0520695d4200350) is a true polyglot — valid MP3 metadata that also contains a hidden VBA script. Execution is triggered through a cmd.exe one-liner that splits the word 'powershell' via environment variables to evade naive command-line detections: cmd /v:on /c "set x=pow&&set y=ershell&&call %windir%\SysWOW64\WindowsPowerShell\v1.0\!x!!y! -E <base64>". The decoded PowerShell stage generates a victim identifier (MD5 of hostname + username), disables TLS certificate validation, implements a custom RC4-variant decoder, performs in-memory AMSI bypass by patching AmsiScanBuffer, then pulls and IEX-executes the final Pterodo RAT payload entirely in memory (fileless). Pterodo is historically associated with Gamaredon Group / Primitive Bear (Russia, FSB-linked) but the source analysis explicitly defers attribution.
macOS path — helper Mach-O Universal Binary: The downloaded file (SHA-256 c8fd1222c3f70f91c401b008711629bf053874dfec315a48758a032acd114b1a) is a fat Mach-O containing both x86_64 and arm64 slices to cover Intel and Apple Silicon Macs. Invocation uses a curl one-liner with tr-based character-translation obfuscation. Earlier variants exfiltrated through api.telegram.org via a hard-coded bot token (bot6529184364:AAEdwM7o7w1Z5XJxQf5H2tHkVfV1mX2QeQ); newer variants use dedicated HTTP infrastructure on dpsmuz[.]com and a DGA pattern on oakenfjrod[.]ru (subdomain = MD5(victim_id)), with requests validated by a custom X-R: 4f2j0n header. The helper reconstructs AMOS in memory from 37 chunks embedded in the __TEXT.__const and __DATA_CONST.__const Mach-O segments; encryption keys are rebuilt from dedicated fragments using XOR with constants 0x34 and 0x8e, and a custom Base64 decoder with 6-bit symbol mapping. Once reconstructed, AMOS harvests Chrome and Firefox cookies/logins/form-data, cryptocurrency wallets (Exodus, Electrum, Atomic, Wasabi), Telegram tdata, the macOS Keychain, iCloud account data, and Desktop/Documents files. It uses dscl . authonly to validate user credentials non-privileged (avoiding sudo prompts) and repeatedly prompts the user with dialogs styled to mimic System Preferences. Collected data is archived with the macOS ditto utility into a ZIP, fragmented if oversized, and exfiltrated via HTTP POST with victim-ID parameters. Persistence is a LaunchAgent that beacons every 60 seconds and executes Base64-decoded commands returned by the C2.
Geographic targeting signal: the macOS variant runs an AppleScript check for a Russian keyboard layout and aborts on match, a long-standing CIS-region exclusion pattern that has historically correlated with Russian-speaking financially-motivated operators. Combined with the use of Pterodo on Windows (Gamaredon lineage), this campaign sits at the intersection of commodity-stealer and nation-state-aligned tradecraft, but no formal attribution has been published.
Defenders should treat this as an active, evolving cross-platform threat. The use of Cloudflare workers.dev / pages.dev for staging means perimeter URL-categorization blocks are insufficient; behavioral detection of ClickFix paste-execute, in-memory PowerShell with AMSI bypass, and macOS LaunchAgents that beacon to non-Apple infrastructure on a 60-second cadence are the highest-fidelity controls. AI-developer audiences are the explicit target — security teams at organizations that allow AI tooling downloads should consider proactive endpoint and user-awareness coverage.
MITRE ATT&CK techniques used in TL-2026-0507
Collection
T1005 Data from Local System; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1568 Dynamic Resolution
Discovery
T1082 System Information Discovery; T1614 System Location Discovery
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Credential Access
T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Persistence
T1543 Create or Modify System Process
Resource Development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
defense-impairment
Affected products and versions in Multi-Stage SEO Poisoning Campaign Delivers Pterodo
- Microsoft — Windows
Vulnerable versions: 10; 11; Server 2016; Server 2019; Server 2022 - Apple — macOS
Vulnerable versions: Ventura 13.x; Sonoma 14.x; Sequoia 15.x - Anthropic — Claude Code (impersonated, NOT vulnerable)
- Google — NotebookLM (impersonated, NOT vulnerable)
Remediation for Multi-Stage SEO Poisoning Campaign Delivers Pterodo
Immediate actions
- Block the listed C2 and staging domains at perimeter DNS and proxy: download-version.1-8-3.com, download.version-516.com, dpsmuz.com, oakenfjrod.ru, and the workers.dev / pages.dev subdomains listed in IOCs
- Sinkhole or block resolution of *.oakenfjrod.ru to defeat the MD5(victim_id) DGA pattern
- Block downloads of files named claude.mp3 with non-audio MIME at the web proxy and quarantine any existing copies matching SHA-256 1df4207e9ad772c0ef96e35a2756626b4af5065f1296bfb7b0520695d4200350
- Quarantine any macOS Mach-O binary named helper matching SHA-256 c8fd1222c3f70f91c401b008711629bf053874dfec315a48758a032acd114b1a
- Alert on cmd.exe spawning powershell.exe with -E (encoded) and environment-variable string-splitting patterns (set x=pow / set y=ershell)
- Alert on macOS LaunchAgents that beacon to non-Apple HTTPS infrastructure on a 60-second cadence
- Push an internal advisory to developer audiences: only install Claude Code from claude.com / Anthropic official channels and NotebookLM only via notebooklm.google.com — never from sponsored search results
Workarounds
- Remove clipboard read/write permissions from browsers for untrusted origins via enterprise policy where supported
- Disable Windows Script Host or VBA macro execution from user-writable paths via AppLocker / WDAC
- Set macOS Gatekeeper to allow only App Store and identified developers, and audit /Library/LaunchAgents and ~/Library/LaunchAgents weekly
Longer-term hardening
- Deploy EDR with in-memory AMSI tamper detection and PowerShell ScriptBlock logging enabled enterprise-wide
- Enable Apple Endpoint Security Framework telemetry for LaunchAgent creation and unsigned-binary execution on managed Macs
- Restrict execution of unsigned and ad-hoc-signed Mach-O binaries via Gatekeeper policy and MDM
- Implement DNS filtering that blocks newly-registered domains and *.workers.dev / *.pages.dev for non-developer user populations
- Add User-Agent and Referer enrichment to web proxy logs to detect Cloudflare-staging fingerprinting patterns
- Run regular SEO / brand-abuse monitoring for sponsored placements impersonating internal-approved AI tools
- Deliver targeted phishing training that explicitly covers ClickFix paste-execute social engineering
Timeline of Multi-Stage SEO Poisoning Campaign Delivers Pterodo
- macOS payload observed running an AppleScript check for Russian keyboard layout and aborting on match — long-standing CIS-region exclusion pattern consistent with Russian-speaking financially-motivated operators.
- Article notes the campaign evolved from NotebookLM-only impersonation to dual Claude Code + NotebookLM targeting; technical complexity decreased (WASM + Telegram dropped, commands embedded directly) — interpreted as adaptation to defensive response.
- helper Mach-O Universal Binary (SHA-256 c8fd1222c3f70f91c401b008711629bf053874dfec315a48758a032acd114b1a) documented — reconstructs AMOS in memory from 37 chunks in __TEXT.__const / __DATA_CONST.__const Mach-O segments.
- claude.mp3 polyglot (SHA-256 1df4207e9ad772c0ef96e35a2756626b4af5065f1296bfb7b0520695d4200350) documented in the wild — MP3 metadata wrapper with hidden VBA triggering env-var-obfuscated PowerShell loader and Pterodo RAT in-memory execution.
- Malpedia adds a library entry referencing the Tarnowski analysis under the osx.amos taxonomy.
- Ireneusz Tarnowski publishes technical analysis on Medium documenting the multi-stage SEO poisoning + ClickFix campaign delivering Pterodo on Windows and AMOS on macOS via Cloudflare Workers/Pages staging.
- Threadlinqs Intelligence ingests source material, maps MITRE ATT&CK coverage across 8 tactics, extracts IOCs, and publishes TL-2026-0507 with cross-platform detection coverage.
- As of 2026-05-29, this SEO-poisoning/ClickFix campaign delivering AMOS (macOS) and a fileless Pterodo-style loader (Windows) via fake Claude Code/NotebookLM installers remains active, with corroborating reports from EclecticIQ (May 21), Microsoft (May 6) and SOC Prime (May 25). No takedown, sinkhole, or arrests; the actor keeps migrating staging to Cloudflare Workers/Pages and evolving payloads to evade defenses.
Sources cited for Multi-Stage SEO Poisoning Campaign Delivers Pterodo
- Multi-stage malware delivery campaign using SEO poisoning and serverless infrastructure
- Malpedia library entry — osx.amos (Atomic macOS Stealer)
- MITRE ATT&CK — User Execution: Malicious Copy and Paste (ClickFix) T1204.004
- MITRE ATT&CK — Stage Capabilities: Drive-by Target T1608.004
- MITRE ATT&CK — Web Service: Bidirectional Communication T1102.002
- Anthropic — Claude Code official download page
- Google — NotebookLM official site
Threats related to Multi-Stage SEO Poisoning Campaign Delivers Pterodo
Detection coverage for TL-2026-0507
As of 2026-05-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0507 across Splunk SPL, Microsoft KQL and Sigma, covering 43 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.