Threat reportMalwareTL-2026-3548
Google Search Poisoning Delivers Trojanized PuTTY MSI with Node.js Loader and EtherHiding C2 Targeting IT Administrators
Google Search Poisoning Delivers Trojanized PuTTY MSI with (TL-2026-3548) is a high-severity malware campaign, first published 2026-10-14. It has no confirmed attribution, affects Microsoft Windows (endpoints of users who install the trojanized, maps to 18 MITRE ATT&CK techniques (T1027, T1036, T1049), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-3548
- Threat ID
- TL-2026-3548
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- information technology, government administration, managed service providers, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Google Search Poisoning Delivers Trojanized PuTTY MSI with
Malware and tooling: Node.js 18.20.5 (node.exe), PuTTY
How Google Search Poisoning Delivers Trojanized PuTTY MSI with works
A campaign poisons Google Search results to lure IT administrators searching for PuTTY to a spoofed download site (puty.ink) that serves a trojanized MSI (Putty-x86_64.msi). The installer runs a genuine Sectigo-signed PuTTY 0.85 as a decoy while deploying a Node.js-based loader that resolves its C2 through an Ethereum smart contract (EtherHiding) and supports reconnaissance, browser profile/cookie theft and near-live screen streaming. Reported by Palo Alto Networks Unit 42 on 2026-10-12.
Unit 42 documented a campaign in which SEO-poisoned Google results for "PuTTY" / "PuTTY download" lead victims to a look-alike site, puty.ink (registered 2026-09-28), via a redirect hop at putredirhelps.online. The site delivers Putty-x86_64.msi from a third-party Backblaze B2 bucket (pattern https://<id>.s3.us-east-005.backblazeb2.com/, observed bucket mnb61ak51). The target audience is IT administrators, whose workstations commonly hold privileged SSH sessions, saved credentials, browser sessions to admin consoles and network reach into server estates.
The MSI drops four files into C:\Users\<user>\AppData\Local\idejDHjFnNXb\: a legitimate, unmodified Sectigo-signed putty.exe (PuTTY 0.85) used as a decoy that opens a normal PuTTY window, an obfuscated batch loader (44JYYsqg.cmd), a 123-byte JScript trampoline (BdbEinqaL7.js) and an obfuscated JavaScript payload stored with an .ini extension (k3TjneJGcwI7.ini). The installer window title KS2FyWDqck and the staging directory name are hardcoded and identical across infections. The batch loader hides its console, checks for an existing Node.js installation and, if none is found, downloads the official Node.js 18.20.5 runtime from nodejs.org via curl and extracts it to the vXA8Jj subdirectory (a bring-your-own-interpreter approach). The JScript trampoline then launches node.exe invisibly via COM ShellExecute with the .ini payload as its argument.
The Node.js payload resolves its command server using EtherHiding: it issues JSON-RPC eth_call requests to the reader contract 0x89F5664d6fD8d990FA04F53253Be4855ed481A74 (function selector 0x7d434425, campaign argument 0x4e7b6e29ab5f4c01e3b9f86a3558a2d99ae0cbaf) through seven public Ethereum RPC endpoints, and uses the most common valid URL returned as the C2 address. The C2 address is refreshed every five minutes, with a hardcoded fallback of presanis.com (registered 2026-09-15). The implant polls the C2 about every 500 ms using requests shaped like static asset fetches: /api/<4-byte-hex>/<client-UUID>/<4-byte-hex>.<png|jpg|gif|css|ico|webp>?<key>=<build-id>, where the build/campaign ID 1835187f-121a-4103-832f-24649a461cac is sent on every poll. Responses longer than 10 bytes are executed in-process with JavaScript new Function(), giving the operator code execution with full Node.js access (require, process, Buffer, console). Because the contract can be updated on-chain, the operator can rotate C2 infrastructure without modifying deployed payloads.
Post-compromise, operators pushed hands-on-keyboard payloads: host reconnaissance (OS version, locale, GPU/graphics hardware, installed antivirus products, domain membership, MachineGuid, active SMB sessions), browser profile and session-cookie collection with transfers reaching hundreds of megabytes, npm installation of a WebSocket package, and a PowerShell loop capturing roughly five desktop screenshots per second as base64 JPEGs written to %LOCALAPPDATA%\Temp\stream_<GUID>_<unix-ms>.txt for near-live screen streaming. No malware family name or threat actor attribution has been published; the activity is unattributed. Note: sources describe the loader behavior but do not document a distinct persistence mechanism beyond the staged files.
MITRE ATT&CK techniques used in TL-2026-3548
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1218.007 Msiexec
Discovery
T1049 System Network Connections Discovery; T1082 System Information Discovery; T1518.001 Security Software Discovery
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.007 JavaScript; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1568 Dynamic Resolution
Collection
T1074.001 Local Data Staging; T1113 Screen Capture
Credential Access
T1539 Steal Web Session Cookie
Resource Development
T1583.001 Domains; T1608.001 Upload Malware; T1608.006 SEO Poisoning
Affected products and versions in Google Search Poisoning Delivers Trojanized PuTTY MSI with
- Microsoft — Windows (endpoints of users who install the trojanized Putty-x86_64.msi)
Vulnerable versions: Not version-specific; social-engineering delivery - PuTTY (impersonated brand) — PuTTY 0.85 (legitimate signed binary used as decoy; not vulnerable or modified)
Remediation for Google Search Poisoning Delivers Trojanized PuTTY MSI with
Immediate actions
- Block puty.ink, putredirhelps.online and presanis.com at DNS/proxy and search EDR/proxy logs for prior contact
- Hunt for the staging directory %LOCALAPPDATA%\idejDHjFnNXb\ and files 44JYYsqg.cmd, BdbEinqaL7.js, k3TjneJGcwI7.ini on admin workstations
- Hunt for node.exe executing from %LOCALAPPDATA% with an .ini file argument and for non-browser processes calling public Ethereum RPC endpoints
- Isolate affected hosts and reset credentials and revoke browser sessions/cookies for accounts used on them, prioritizing privileged and SSH/admin console accounts
Workarounds
- Block MSI downloads from consumer cloud storage hosts such as backblazeb2.com where not business-required
- Block outbound connections to eth_call-capable public RPC endpoints from non-crypto workstations
Longer-term hardening
- Distribute PuTTY only from the official site or an internal software repository and train administrators to avoid search-engine download links
- Alert on node.exe and curl.exe launched by msiexec.exe or cmd.exe during MSI installs
- Restrict outbound access to public Ethereum RPC services from endpoints that have no business need for blockchain traffic
- Enforce application control to block unsanctioned runtimes executing from user-writable AppData paths
Timeline of Google Search Poisoning Delivers Trojanized PuTTY MSI with
- Fallback C2 domain presanis.com registered (per Unit 42 report)
- Spoofed PuTTY download domain puty.ink registered
- SEO-poisoned Google results for PuTTY observed ranking the spoofed puty.ink page, redirecting through putredirhelps.online to Putty-x86_64.msi on Backblaze B2
- Palo Alto Networks Unit 42 publishes timely threat intel report on the MSI impersonating PuTTY and its Node.js/EtherHiding loader
- Security press (GBHackers and others) begins covering the campaign and its Ethereum-based C2 resolution
- Cyber Security News reports the campaign targeting IT administrators; campaign described as actively distributing at time of reporting
Sources cited for Google Search Poisoning Delivers Trojanized PuTTY MSI with
- Hackers Abuse Google Search to Attacks ITadmins with Weaponized PuTTY Installer
- Unit 42 Timely Threat Intel: MSI impersonating PuTTY delivers malware
- Hackers Target PuTTY Users With SEO Poisoning and Ethereum-Powered Malware (GBHackers)
- Hackers Abuse Google Search to Attack IT Admins with Weaponized PuTTY Installer (Cryptika)
- Usan Google para atacar administradores con PuTTY modificado (elhacker.NET)
- Unit 42 Timely Threat Intel repository (Palo Alto Networks)
Detection coverage for TL-2026-3548
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3548 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3548
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.