Hackers Use SEO Poisoning to Impersonate Gemini CLI and Claude Code Installers

Hackers are targeting software developers by creating fake installation pages for two popular AI coding tools, Gemini CLI and Claude Code.

The attackers are using a technique called SEO poisoning to push their malicious websites above real ones in search results, tricking developers into running dangerous commands on their own machines.

The campaign began surfacing in early March 2026 and has expanded beyond AI tools. Victims are lured to fake pages nearly identical to official installation guides, where they paste a single PowerShell command into their terminal.

That one action quietly deploys a powerful infostealer capable of draining credentials, session tokens, and sensitive files.

EclecticIQ analysts identified this ongoing campaign and found that the malware runs entirely in memory through PowerShell, leaving no files on disk. 

EclecticIQ said in a report shared with Cyber Security News (CSN) that the infostealer harvests credentials from a wide range of applications before exfiltrating the results in encrypted form to a command-and-control server.

The stolen data includes OAuth tokens, CI/CD credentials, corporate VPN details, and session cookies from platforms like Slack, Microsoft Teams, Discord, and Telegram.

A valid session cookie lets an attacker step directly into a victim’s workspace, bypassing both passwords and multi-factor authentication. This access fuels demand in underground access broker markets.

Beyond credential theft, the malware gives attackers the ability to run additional code on infected machines remotely.

While no persistence mechanism was found in the script, this capability means operators can follow up with deeper intrusions, turning a single developer workstation into an enterprise-wide breach.

Hackers Use SEO Poisoning

The infection chain is simple but effective. A developer searches for how to install Gemini CLI or Claude Code, and the top result looks exactly like the official page.

In the Gemini campaign, victims were directed to geminicli[.]co[.]com, which prompted a PowerShell command that silently downloads an infostealer payload called Install.ps1 from gemini-setup[.]com.

What makes this trick so convincing is that the real Gemini CLI installs in parallel. The genuine npm package completes in the terminal, giving users every reason to believe nothing went wrong.

By the time the tool is ready, the infostealer has already finished collecting and sending the victim’s data.

The Claude Code campaign followed the same playbook. On March 30, 2026, the threat actor registered claudecode[.]co[.]com and claude-setup[.]com using identical naming patterns.

The cloned page matched official documentation closely enough to deceive most users, and exfiltrated data was sent to events[.]ms709[.]com.

EclecticIQ analysts pivoted from those domains using passive DNS records and uncovered a cluster of over 30 malicious domains also impersonating Node.js, Chocolatey, KeePassXC, and Monero.

Most were registered between late March and early April 2026, pointing to a coordinated, active campaign.

Fileless PowerShell Stealer Built to Evade Detection

Once the second-stage payload runs, it immediately disables core Windows defenses. It patches Event Tracing for Windows to suppress logging and bypasses the Antimalware Scan Interface, letting the rest of the script run undetected.

The script spans roughly 6,800 lines of junk code and includes a sandbox check to avoid analysis environments. The stealer loads three C# components at runtime to probe deep into the host.

One dumps Windows Credential Manager entries, another captures screen resolution for fingerprinting, and a third lists running processes through the Restart Manager API to sidestep detection.

Everything runs inside PowerShell without writing a single file to disk. To defend against this threat, EclecticIQ recommends hunting for the irm | iex pattern in command-line logs and alerting on hidden PowerShell executions.

Enforcing PowerShell Constrained Language Mode, using FIDO keys for privileged accounts, and deploying short-lived OAuth tokens can meaningfully limit the damage if credentials are stolen. 

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Use SEO Poisoning to Impersonate Gemini CLI and Claude Code Installers appeared first on Cyber Security News.