Fake AI Developer Tool Installers Delivering Infostealer via SEO Poisoning and Typosquatting — Threadlinqs Intelligence
As of 2026-08-03, Fake AI Developer Tool Installers Delivering Infostealer via SEO Poisoning and Typosquatting is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-1845 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
A financially motivated eCrime campaign targeting software developers with fake installers impersonating Claude Code, Google Gemini CLI, and the OpenClaw project. SEO-poisoned search results and
This campaign encompasses two highly correlated attack vectors — both leveraging typosquatting and social engineering to deliver infostealer malware to developer workstations. The first vector, documented by EclecticIQ and Infosecurity Magazine, uses SEO poisoning to place typosquatted domains such as 'geminicli.co.com' and 'claudecode.co.com' above legitimate search results for 'install Gemini CLI' and 'install Claude Code'. Victims are served a cloned installation page and prompted to copy-paste a PowerShell command into their terminal. The command executes a dual-install technique: it silently runs a second-stage fileless PowerShell infostealer via Shell.Application COM object with window style 0 (hidden), while simultaneously installing the legitimate npm package — so the victim sees a successful installation. The PowerShell infostealer (~6,800 lines of obfuscated junk code branches) immediately patches AMSI (amsi.dll in-process patching) and suppresses ETW (PSEtwLogProvider.m_enabled flag), then loads three embedded C# assemblies via Add-Type: CredHelper (CredEnumerate from advapi32.dll for Windows Credential Manager), User32 (EnumDisplaySettings for screen fingerprinting), and Rstrtmgr (Restart Manager API for stealthy process enumeration). It collects credentials, session cookies, and configuration data from 65+ Chromium/Firefox browser profiles, Slack (Local State key and network cookies), Microsoft Teams (EBWebView partitioned cookies, DPAPI-decrypted), Discord (Local Storage LevelDB), Mattermost, Telegram Desktop (tdata directory), Zoom (DPAPI-protected win_osencrypt_key), enterprise platforms (Notion, Zoho Mail, Evernote, LiveChat), remote access tools (WinSCP registry sessions, PuTTY saved sessions, OpenVPN configs with embedded key material), cryptocurrency wallets (Brave Wallet, Spectre), and cloud storage directories (Proton Drive, iCloud Drive, Google Drive, MEGA, OneDrive). Exfiltrated data is sent to C2 endpoints at events.ms709.com (Claude campaign) and events.msft23.com (Gemini campaign) via HTTPS POST to /process, with each response returning an RSA-encrypted task list for remote code execution. No persistence mechanism was found in this vector, requiring repeated social engineering for reinfection.
The second vector, documented by Netskope Threat Labs and Huntress, targets developers and gamers with fake OpenClaw installers hosted on typosquatted GitHub repositories (openclaw-installer organization, throwaway account bgodimpulse7) and the domain openclaw-installer.com (registered March 9, 2026, behind Cloudflare). The download is a Rust-based dropper labeled 'Hologram' padded to 130MB to bypass AV file-size thresholds and sandbox upload limits. The Hologram framework delivers a six-binary modular implant: Stealth Packer C2 beacon/CLR loader (svc_service.exe), HTTPS C2 tunnel (virtnetwork.exe), reflective PE loader via NT syscall thread injection (onedrive_sync.exe, 13MB), system fingerprinter (audioeq.exe), two independent Telegram-bot droppers (WinHealhCare.exe, OneSync.exe), and the Vidar infostealer (vicloud.exe). The malware performs multi-tier anti-analysis: BIOS string and hardware profile checks, physical mouse-movement gate (execution stops without it), low-memory sandbox detection, uptime checks (minutes-old processes flagged), and a 29,000-year Sleep() call after producing artifacts to defeat timed sandboxes. It also calls ip-api.com to geolocate the victim, captures a full desktop screenshot as 24-bit BMP, and disables WinINet proxy auto-detection in the registry to bypass corporate inspection proxies. Persistence is established through three layers: Run registry autorun, WinLogon Userinit hijack, and scheduled tasks, plus independent Telegram-bot droppers that can re-infect even if primary payloads are removed. The C2 infrastructure is notably multi-layered: initially beacons via Hookdeck webhook relay (hkdk.events/djbk1i9hp0sqoh) that forwards to a Telegram channel (t.me/b8bz11 -> t.me/hgo9t
Target sectors: software development, technology, cryptocurrency, gaming
Target regions: North America, Europe, united kingdom, united states of america
Detections & IOCs
As of 2026-08-25, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1059.001, T1204.002, T1218, T1547.001, T1547.004, T1053.005, T1027, T1685, T1497.001, T1140
