Executive Summary
In early 2026, a sophisticated infostealer campaign surfaced targeting developers and IT administrators by impersonating popular AI coding assistants, specifically Google's Gemini CLI and Anthropic's Claude Code. Threat actors leverage SEO poisoning to place malicious typosquatted domains (e.g., geminicli[.]co[. ]com) at the top of search results. Victims are tricked into running a PowerShell command that installs the legitimate tool while simultaneously executing a fileless infostealer in memory.
The technical chain involves a concealed PowerShell script that disables Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI) to evade detection. The malware uses P/Invoke calls to interact with the Windows Credential Manager and the Restart Manager API to enumerate processes without triggering standard monitoring. It targets a vast array of sensitive data including browser credentials, session cookies for collaboration platforms like Slack and Teams, VPN configurations, and cloud storage directories.
This campaign represents a significant supply chain risk, as it specifically targets high-privilege developer workstations to obtain initial access into corporate environments. By harvesting session tokens and OAuth credentials, attackers can bypass MFA and gain persistent access to internal source code repositories and communication channels. The infrastructure has been linked to a wider cluster of domains impersonating other developer tools like Node.js and Chocolatey.