# Multi-Stage SEO Poisoning Campaign Delivers Pterodo (Windows) and AMOS (macOS) via Cloudflare Workers/Pages and ClickFix — Fake Claude Code / NotebookLM Installers

> Active cross-platform malware delivery campaign poisons sponsored search results for 'Claude Code' and 'NotebookLM download', funnels victims through phishing pages on Squarespace, Tilkly, and Bitbucket Pages, then uses ClickFix social engineering to land Pterodo RAT on Windows (via a polyglot MP3/VBA claude.mp3) and AMOS (Atomic macOS Stealer) on macOS (via a Mach-O Universal Binary helper loader). Late-stage staging hides on Cloudflare workers.dev and pages.dev subdomains to blend with legitimate SaaS traffic.

- **Published:** 2026-05-13T12:00:00Z
- **Last reviewed:** 2026-05-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0507
- **ID:** TL-2026-0507
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 43 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Threadlinqs Intelligence is tracking an active multi-stage malware distribution operation publicly analyzed by Ireneusz Tarnowski on 2026-05-03 (Medium) and cataloged by Malpedia the same day. The campaign weaponizes the popularity of AI developer tooling — specifically Anthropic's Claude Code CLI and Google's NotebookLM — by purchasing sponsored search placements and SEO-poisoning organic results for 'Claude Code' and 'NotebookLM download'. Victims who click are funneled through phishing landing pages hosted on legitimate, high-reputation SaaS platforms (Squarespace, Tilkly, Bitbucket Pages, plus an iina-technical[.]com lookalike) that are unlikely to be blocked by category-based web filtering.

The initial landing pages do not host the malware directly. Instead they present a ClickFix social-engineering modal driven by an install-modal.js script and, in earlier variants, a connector_bg.wasm WebAssembly module with access to fetch, localStorage, navigator.userAgent and crypto APIs. The modal displays platform-specific instructions and silently writes a command to the system clipboard, telling the user to open Terminal (macOS) or Run/cmd.exe (Windows) and paste-execute it. Late variants embed the command directly in code rather than retrieving it from a C2 first — a deliberate simplification observed by Tarnowski as the operators reacted to defensive pressure.

The pasted command pulls a stage-two loader from a Cloudflare Workers or Pages subdomain (workers.dev / pages.dev). The Cloudflare staging node performs User-Agent fingerprinting, returning the Windows polyglot only to Windows browsers and the macOS Mach-O only to macOS browsers; non-matching User-Agents receive decoys or 404s. This per-victim routing is a hallmark of the campaign and frustrates retroactive analysis.

Windows path — claude.mp3 polyglot: The downloaded file (SHA-256 1df4207e9ad772c0ef96e35a2756626b4af5065f1296bfb7b0520695d4200350) is a true polyglot — valid MP3 metadata that also contains a hidden VBA script. Execution is triggered through a cmd.exe one-liner that splits the word 'powershell' via environment variables to evade naive command-line detections: cmd /v:on /c "set x=pow&&set y=ershell&&call %windir%\SysWOW64\WindowsPowerShell\v1.0\!x!!y! -E <base64>". The decoded PowerShell stage generates a victim identifier (MD5 of hostname + username), disables TLS certificate validation, implements a custom RC4-variant decoder, performs in-memory AMSI bypass by patching AmsiScanBuffer, then pulls and IEX-executes the final Pterodo RAT payload entirely in memory (fileless). Pterodo is historically associated with Gamaredon Group / Primitive Bear (Russia, FSB-linked) but the source analysis explicitly defers attribution.

macOS path — helper Mach-O Universal Binary: The downloaded file (SHA-256 c8fd1222c3f70f91c401b008711629bf053874dfec315a48758a032acd114b1a) is a fat Mach-O containing both x86_64 and arm64 slices to cover Intel and Apple Silicon Macs. Invocation uses a curl one-liner with tr-based character-translation obfuscation. Earlier variants exfiltrated through api.telegram.org via a hard-coded bot token (bot6529184364:AAEdwM7o7w1Z5XJxQf5H2tHkVfV1mX2QeQ); newer variants use dedicated HTTP infrastructure on dpsmuz[.]com and a DGA pattern on oakenfjrod[.]ru (subdomain = MD5(victim_id)), with requests validated by a custom X-R: 4f2j0n header. The helper reconstructs AMOS in memory from 37 chunks embedded in the __TEXT.__const and __DATA_CONST.__const Mach-O segments; encryption keys are rebuilt from dedicated fragments using XOR with constants 0x34 and 0x8e, and a custom Base64 decoder with 6-bit symbol mapping. Once reconstructed, AMOS harvests Chrome and Firefox cookies/logins/form-data, cryptocurrency wallets (Exodus, Electrum, Atomic, Wasabi), Telegram tdata, the macOS Keychain, iCloud account data, and Desktop/Documents files. It uses dscl . authonly to validate user credentials non-privileged (avoiding sudo prompts) and repeatedly prompts the user with dialogs styled to mimic System Preferences. Collected data is archived with the macOS ditto utility into a ZIP, fragmented if oversized, and exfiltrated via HTTP POST with victim-ID parameters. Persistence is a LaunchAgent that beacons every 60 seconds and executes Base64-decoded commands returned by the C2.

Geographic targeting signal: the macOS variant runs an AppleScript check for a Russian keyboard layout and aborts on match, a long-standing CIS-region exclusion pattern that has historically correlated with Russian-speaking financially-motivated operators. Combined with the use of Pterodo on Windows (Gamaredon lineage), this campaign sits at the intersection of commodity-stealer and nation-state-aligned tradecraft, but no formal attribution has been published.

Defenders should treat this as an active, evolving cross-platform threat. The use of Cloudflare workers.dev / pages.dev for staging means perimeter URL-categorization blocks are insufficient; behavioral detection of ClickFix paste-execute, in-memory PowerShell with AMSI bypass, and macOS LaunchAgents that beacon to non-Apple infrastructure on a 60-second cadence are the highest-fidelity controls. AI-developer audiences are the explicit target — security teams at organizations that allow AI tooling downloads should consider proactive endpoint and user-awareness coverage.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1480 Execution Guardrails
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1102 Web Service
- T1568 Dynamic Resolution
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [Multi-stage malware delivery campaign using SEO poisoning and serverless infrastructure](https://medium.com/@ireneusz.tarnowski/multi-stage-malware-delivery-campaign-using-seo-poisoning-and-serverless-infrastructure-34e05e551fa3)
- [Malpedia library entry — osx.amos (Atomic macOS Stealer)](https://malpedia.caad.fkie.fraunhofer.de/library/dd496470-d7a3-4030-9a2e-47a540417db9/)
- [MITRE ATT&CK — User Execution: Malicious Copy and Paste (ClickFix) T1204.004](https://attack.mitre.org/techniques/T1204/004/)
- [MITRE ATT&CK — Stage Capabilities: Drive-by Target T1608.004](https://attack.mitre.org/techniques/T1608/004/)
- [MITRE ATT&CK — Web Service: Bidirectional Communication T1102.002](https://attack.mitre.org/techniques/T1102/002/)
- [Anthropic — Claude Code official download page](https://www.anthropic.com/claude-code)
- [Google — NotebookLM official site](https://notebooklm.google.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0507