SEO Poisoning: Threat Actors Target AI Developers via Malicious CLI Impersonation

A sophisticated SEO poisoning campaign is currently targeting the developer community, leveraging the rapid adoption of AI-driven development tools to distribute advanced infostealer malware. By impersonating high-profile command-line interfaces (CLIs) such as Gemini CLI and Claude Code, attackers are successfully intercepting developers seeking legitimate installation workflows.

First identified in early March 2026, this campaign utilizes highly optimized malicious domains designed to outrank official documentation in search engine results. When developers land on these fraudulent sites—which feature near-perfect visual replicas of trusted vendor documentation—they are prompted to execute seemingly standard PowerShell commands. In reality, these commands serve as the initial entry vector for a deep system compromise.

A detailed analysis of the campaign by EclecticIQ reveals a highly structured technical approach. For example, users searching for Gemini CLI are redirected to typosquatted domains like geminicli[.]co[.]com. The site guides users through a fake setup process, leading them to execute a PowerShell command that silently fetches a malicious script from gemini-setup[.]com.

To maintain a low forensic footprint, the malware operates primarily in-memory. This “fileless” execution strategy allows the payload to bypass traditional disk-based scanning, effectively evading standard antivirus solutions.

Technical Analysis: Dual-Execution and Defense Evasion

The campaign’s most deceptive element is its dual-execution methodology. While the malicious background process is initializing, the script simultaneously installs the legitimate tool (e.g., via npm). This provides immediate visual confirmation to the user that the installation was successful, masking the fact that an infostealer has already been deployed.

Parallel infrastructure has been identified targeting Anthropic’s Claude Code, utilizing domains such as claudecode[.]co[.]com and claude-setup[.]com. This pattern suggests a unified threat actor managing a broad portfolio of spoofed developer assets.

The malware is engineered for maximum stealth and impact. Upon execution, it attempts to disable critical Windows security mechanisms, specifically:

• Event Tracing for Windows (ETW): To blind security monitoring and telemetry.
• Antimalware Scan Interface (AMSI): To prevent real-time scanning of PowerShell scripts.

Once the defenses are neutralized, the infostealer begins harvesting a massive array of sensitive data, including:

• Credentials & Sessions: Browser passwords, session cookies, and OAuth tokens.
• Development Secrets: SSH keys and VPN configurations.
• Enterprise Collaboration: Data from Slack, Microsoft Teams, Discord, and Zoom.
• Financial Assets: Cryptocurrency wallet files and cloud storage directories.

Furthermore, the payload supports Remote Code Execution (RCE). This functionality allows attackers to pivot from automated data theft to interactive, “hands-on-keyboard” sessions, significantly increasing the risk of lateral movement within an enterprise network.

Infrastructure intelligence indicates that the attackers utilize “bulletproof” hosting to maintain their command-and-control (C2) nodes, such as events[.]msft23[.]com. The campaign extends beyond AI tools, with over 30 domains impersonating widely used developer utilities like Node.js, Chocolatey, and KeePassXC.

Defensive Recommendations

To mitigate the risk of infection from these SEO-driven attacks, security operations centers (SOCs) and developers should implement the following:

• Monitor PowerShell Activity: Watch for suspicious command chaining, particularly the use of Invoke-RestMethod combined with Invoke-Expression (IEX).
• Validate Installation Sources: Always verify the official documentation and repository URLs before executing CLI installation commands.
• Endpoint Detection: Look for unusual outbound network connections immediately following the execution of administrative scripts.
• Privilege Management: Limit the use of elevated privileges for routine development tasks to reduce the potential blast radius of an infection.

Indicators of Compromise (IOCs)

Domains

SHA-256 Hashes

Note: Domains are intentionally defanged (e.g., [.]) to prevent accidental resolution. Re-fang only within controlled threat intelligence platforms.