SEO-Poisoned Fake Developer Tool Pages Deliver Fileless PowerShell Infostealer

May 21, 2026 · Original article ↗

Summary

EclecticIQ details an ongoing campaign using SEO-poisoned fake developer-tool pages to deliver a fileless PowerShell infostealer that steals credentials, tokens, cookies and files, then exfiltrates data and can run follow-on payloads.

Key points

SEO-poisoned pages impersonate Gemini CLI, Claude Code, Node.js, Chocolatey and other tools, prompting users to paste a PowerShell command; the genuine Gemini CLI may install at the same time.
The in-memory payload disables ETW telemetry, bypasses AMSI, uses heavy obfuscation and checks for qemu-ga as a basic anti-sandbox measure.
The stealer targets browser credentials and cookies, OAuth tokens, collaboration-app sessions, CI/CD secrets, VPN details, cloud-synced folders and local files.
Encrypted data is sent to C2 endpoints; the implant can receive operator tasking and execute follow-on payloads. The report found no persistence method in the analyzed script.
EclecticIQ's passive-DNS pivots identified a cluster of more than 30 domains, which the report assesses as likely part of a coordinated campaign.
The report recommends hunting for PowerShell download-and-execute patterns and hidden execution, and suggests controls including Constrained Language Mode, application-control policies and short-lived OAuth tokens.

Article Details

Attack Vectors: SEO poisoning placed fake Gemini CLI, Claude Code, and other developer-tool installation pages above legitimate search results.
The fake pages prompted users to paste and run a PowerShell one-liner that retrieved and executed a second-stage infostealer in memory.
The first-stage script launched hidden PowerShell while installing the genuine Gemini CLI, making the activity appear legitimate to the victim.
Fake Node.js and Chocolatey installation flows used spoofed domains and a PowerShell download-and-execute command to deliver the same infostealer.
Defensive Notes: Hunt for PowerShell command lines chaining Invoke-RestMethod or irm with Invoke-Expression or iex.
Alert on hidden PowerShell launched with -WindowStyle Hidden or through Shell.Application.ShellExecute.
Monitor PowerShell sessions using Add-Type and P/Invoke calls to advapi32.dll!CredEnumerate.
Detect HTTP requests to /take, /process, and /validate, particularly when associated with PowerShell user-agent strings.
Enforce PowerShell Constrained Language Mode on standard developer workstations using WDAC or AppLocker.
Use WDAC or AppLocker rules to prevent PowerShell from executing scripts downloaded from the internet, and enforce Mark-of-the-Web protections.
Use FIDO keys and short-lived OAuth tokens with conditional access on developer-tier accounts to limit the value of stolen credentials and session material.
Consider restricting clipboard writes from untrusted sites and provide developer-focused awareness guidance about paste-and-execute lures.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`api[.]bio9438[.]com`	Listed among attacker-controlled domains in the campaign infrastructure.
DOMAIN	`chocolatey-download[.]co[.]com`	Listed as an attacker-controlled domain associated with Chocolatey impersonation.
DOMAIN	`chocolatey-setup[.]co[.]com`	Listed as an attacker-controlled domain associated with Chocolatey impersonation.
DOMAIN	`chocolatey[.]co[.]com`	Listed as an attacker-controlled domain associated with Chocolatey impersonation.
DOMAIN	`chocolatey[.]net`	Listed as an attacker-controlled campaign domain.
DOMAIN	`claude-code[.]co[.]com`	Campaign domain used in passive-DNS infrastructure pivoting and reported as hosted on the listed bulletproof-hosting IP.
DOMAIN	`claude-setup[.]com`	Payload host used in the Claude Code impersonation campaign.
DOMAIN	`claudecode-install[.]co[.]com`	Listed among attacker-controlled campaign domains; the article does not specify its individual function.
DOMAIN	`claudecode[.]co[.]com`	Cloned Claude Code installation page that presented victims with a malicious PowerShell command.
DOMAIN	`events[.]ms709[.]com`	Command-and-control domain used by the Claude Code campaign and cited as a rotated endpoint in the wider campaign.
DOMAIN	`events[.]msft23[.]com`	Command-and-control domain used by the Gemini impersonation campaign to stage data and receive exfiltrated host information.
DOMAIN	`gemini-setup[.]com`	Payload host contacted by the fake Gemini CLI installation command to retrieve Install.ps1.
DOMAIN	`geminicli[.]co[.]com`	Fake Gemini CLI installation page used to direct victims to the infostealer download.
DOMAIN	`geninicli[.]co[.]com`	Listed among attacker-controlled campaign domains; the article does not specify its individual function.
DOMAIN	`get-monero[.]co[.]uk`	Listed as an attacker-controlled domain associated with a Monero lure.
DOMAIN	`getmonero[.]us[.]com`	Listed as an attacker-controlled domain associated with a Monero lure.
DOMAIN	`keepassxc[.]us[.]com`	Listed as an attacker-controlled domain associated with KeePassXC impersonation.
DOMAIN	`keepassxc[.]us[.]org`	Listed as an attacker-controlled domain associated with the campaign's KeePassXC impersonation lures.
DOMAIN	`metrics[.]msft17[.]com`	Listed among attacker-controlled campaign domains; the article does not specify its individual function.
DOMAIN	`nodejs-setup[.]co[.]com`	Fake Node.js installation page that instructed visitors to run a malicious PowerShell command.
DOMAIN	`olive3451[.]com`	Listed among attacker-controlled campaign domains; the article does not specify its individual function.
DOMAIN	`openclow[.]co[.]com`	Listed among attacker-controlled campaign domains; the article does not specify its individual function.
IPV4	`109[.]107[.]170[.]111`	Hosting IP reported for the campaign domain claude-code.co[.]com and associated with the infrastructure pivot.
SHA256	`9c87e8162b39fbb773c416006b16f8e34aca53372d1b2d4a584df0ffc69ad333`	SHA-256 hash of a sample listed in the report's infostealer indicators.
SHA256	`ff81cb9263fcde5870a0748fd6af2d30a4ba864415c15ca14827d0dd723eb60c`	SHA-256 hash of a sample listed in the report's infostealer indicators.
URL	`hxxps[:]//community[.]chocolatey[.]net/install.ps1`	Specific PowerShell script URL used in the fake Node.js/Chocolatey installation flow to deliver the infostealer.