Attackers Abuse SEO Poisoning to Spread Fake Gemini and Claude Installers

Threat actors are using SEO-poisoned, typosquatted installation pages for popular AI developer tools (Gemini CLI, Claude Code, Node.js, etc.) to lure developers into pasting a one-line PowerShell command that installs a legitimate package while loading a fileless infostealer. The malware disables ETW/AMSI, runs in memory, harvests session cookies, credentials, VPN and remote access data, and exfiltrates to C2 servers; researchers observed multiple related domains, a hosting IP, C2 endpoints, and a downloader script name and recommend hunting for 'irm | iex' patterns and enforcing PowerShell constrained language on developer workstations.