Enterprise adoption of artificial intelligence platforms has created a lucrative new attack surface for financially motivated threat actors.
By weaponizing search engine optimization (SEO), cybercriminals are hijacking developer workflows to deliver highly evasive, fileless infostealers.
These campaigns masquerade as official installation pages for popular developer tools such as Google’s Gemini CLI and Anthropic’s Claude Code, posing a direct supply-chain risk to corporate networks.
The infection cycle begins when a developer searches for AI tooling instructions on Google. Attackers use SEO poisoning to push malicious domains, such as geminicli[.]co[.]com, above legitimate vendor results.
When a victim visits the site, they find a visually convincing clone of the official documentation instructing them to paste a seemingly standard PowerShell command into their terminal.
Fake Gemini CLI Installers
Executing the provided PowerShell command triggers a sophisticated dual-action sequence designed to avoid suspicion.
The script silently reaches out to an attacker-controlled server to download a fileless infostealer payload directly into memory using an irm | iex command structure.
Simultaneously, the script installs the genuine Gemini CLI package from the official npm registry. Developers see normal progress bars and a working application, unaware that a malicious payload is already executing in the background.
Once active in memory, the malware immediately neutralizes Microsoft Windows endpoint visibility. It patches Windows Event Tracing for Windows (ETW) to suppress PowerShell telemetry and disables the Antimalware Scan Interface (AMSI).
This allows the heavily obfuscated script to run without triggering signature-based or heuristic security alerts.
While operating in this unmonitored state, the malware uses the Windows Restart Manager API and C# reflection to interrogate the host.
It actively targets developer workstations by extracting stored credentials, session cookies, and local state keys from enterprise communication tools like Slack, Microsoft Teams, and Discord.
Stealing these active session tokens allows attackers to bypass multi-factor authentication requirements completely.
eclecticiq research, capturing critical infrastructure access tokens. It targets remote access tools like WinSCP and PuTTY, OpenVPN configuration files, and locally synced cloud storage directories.
All harvested data is encrypted and exfiltrated to command-and-control (C2) servers designed to mimic legitimate Microsoft infrastructure, such as events[.]msft23[.]com.
Defenders must prioritize detecting the initial staging commands and blocking access to known malicious infrastructure.
Enforcing PowerShell Constrained Language Mode and utilizing application control to prevent script execution from untrusted sources are highly effective mitigation strategies.
Indicators of Compromise
| Category | Indicator or Technique | Details |
|---|---|---|
| Malicious Domains | claudecode[.]co[.]com, geminicli[.]co[.]com | Fake installation pages mimicking vendor sites |
| C2 Infrastructure | events[.]msft23[.]com, events[.]ms709[.]com | Receives exfiltrated data via /process endpoint |
| Target Applications | Teams, Slack, WinSCP, OpenVPN, Chrome | Attackers target session cookies and access tokens |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
