EtherRAT Uses SEO Poisoning and Fake GitHub Pages to Target Enterprise Admins

Atos Threat Research Center uncovered "EtherRAT," a sophisticated targeted campaign that poisons search results to present malicious GitHub facade repositories as trusted administrative tool downloads, redirecting victims to MSI installers that deploy a multi-stage, fileless JavaScript RAT which uses an Ethereum smart contract for dynamic C2; the operation targets high-privilege IT professionals, has at least 44 observed facade repositories, and emphasizes stealth and infrastructure resilience.