EtherRAT Campaign Uses SEO Poisoning and GitHub Facades to Target Enterprise Admins

A sophisticated campaign is actively targeting high‑privilege IT staff by poisoning search results to surface professional-looking GitHub facades that link to hidden repositories hosting malicious MSI installers. The multi-stage payload (EtherRAT) uses an obfuscated MSI-launched batch, an in-memory Node.js stage, and a JavaScript RAT persisted to run under conhost.exe; it retrieves C2 via the Ethereum blockchain to resist takedowns. The report documents 17 separate GitHub facades (Dec 2024–Apr 2026), behavioral IOCs (high-frequency beacons, periodic ETH RPC requests, conhost.exe with headless argument), and recommended mitigations including network blocks, telemetry reviews, and stricter sourcing controls for admin tools.