Trojanized Gemini and Claude Installers Target Developers Via SEO Poisoning

Cybercriminals are using SEO-poisoned, typosquatted sites that mimic AI developer tools (e.g., geminicli.co.com, claudecode.co.com) to trick developers into running a PowerShell command that downloads a fileless infostealer. The in-memory payload disables AMSI/ETW, steals browser credentials, DPAPI-protected app/session keys, cloud-stored files and crypto wallet data, provides remote code execution, and exfiltrates encrypted data to C2 domains such as vents.msft23.com, events.ms709.com, and mo2307.com; the campaign has been active since March–May 2026 and even used a stolen EV certificate to bypass warnings.