Fake Gemini and Claude Installers Drain Developer Secrets via SEO Poisoning

A single line of PowerShell, copied from a Google search result, is enough to hand over a developer’s browser sessions, Slack tokens, VPN configs, and crypto wallets. Since early March 2026, that one line has been sitting on convincing copies of Google’s Gemini CLI and Anthropic’s Claude Code install pages, ranked above the genuine ones in search.

EclecticIQ, the Dutch threat intelligence firm that published the full attack chain on 21 May 2026, traced the campaign to a single financially motivated actor targeting United States and United Kingdom developers. The bait works because the malicious script also runs the real npm package in the background, so the tool a developer wanted shows up in the terminal exactly as the documentation promised.

The Bait That Looks Like the Real Tool

When a developer types install gemini cli into Google, the SEO-poisoned result that lands at the top of the page sends them to geminicli.co.com, a typosquat of Google’s canonical documentation. The clone replicates the official install page almost verbatim, down to the syntax-highlighted code block and the brand colors.

The instructions are a single PowerShell one-liner. Pasting it into Windows Terminal pulls start.ps1 from gemini-setup.com, which then runs two things in parallel: npm install -g @google/gemini-cli, which gives the developer the legitimate tool, and a fileless infostealer that never writes a file to disk.

A parallel flight, registered on 30 March, did the same to Claude Code. The fake claudecode.co.com mirrors Anthropic’s install page and routes victims to claude-setup.com. Anthropic users flagged the impersonation in a public GitHub issue within hours, but Google’s index kept ranking the bad domain through April.

Why a PowerShell One-Liner Is the Perfect Lure for Developers

The campaign exploits a quirk of the audience: the targets behave like security professionals on every other download and like beginners on this one. A developer who would refuse to run an unsigned EXE will paste a PowerShell command into a terminal if the documentation says to, because that is exactly how legitimate CLI tools install today.

Gemini CLI reached public release in 2025. Anthropic’s coding agent reached general availability later the same year. Neither tool has the years of muscle memory that protect a familiar package manager from being misdirected, and neither has a settled canonical URL the way nodejs.org is canonical for Node. The SEO-poisoned imposter is genuinely the first result a curious engineer sees.

The dual-execution trick removes the last warning sign. The real Gemini CLI prints its real welcome banner, accepts its real authentication flow, and starts answering prompts. The developer feels a small win, closes the terminal tab, and moves on. The infostealer has roughly the same minute of activity to grab everything it can before any endpoint product spots the PowerShell session.

Bitdefender researchers tracked the same operator buying Google Ads slots for adjacent typo variants in late March, documenting the cross-platform reach into macOS as well as Windows. That second front widens the target set well past Windows-only developers.

Inside the Fileless Infostealer’s Payload

The downloaded start.ps1 never touches disk in the traditional sense. It loads, patches, and executes entirely in memory through PowerShell, which Windows treats as administrator scripting rather than as user-installed software. Local antivirus engines watching for new EXEs on disk see nothing.

Patching AMSI and ETW Before Anything Else

Before pulling any data, the script disables the two logging layers Windows uses to catch in-memory abuse. The Antimalware Scan Interface (AMSI, the Microsoft hook that lets antivirus engines scan PowerShell scripts before they execute) is neutralized through an in-memory patch of amsi.dll. Event Tracing for Windows (ETW, the kernel-level telemetry pipeline) is silenced by flipping the PSEtwLogProvider.m_enabled flag, which kills PowerShell-specific events at the source.

The script then checks for the qemu-ga string, a fingerprint of QEMU-based sandbox environments, and quits if it finds one. That sandbox evasion means most automated malware-detonation systems run the script, see nothing happen, and tag the file as benign.

The Data Collection Sweep

With telemetry blinded, the payload walks a target list spanning browsers, communication apps, cloud sync folders, and crypto wallets, encrypting the haul before exfiltration to three command-and-control hosts. EclecticIQ’s reverse engineering of the binary documented the breadth:

• Nine browsers including Chrome, Edge, Brave and Firefox give up login data, cookies, autofill records and saved form history.
• Eight chat and meeting apps including Slack, Microsoft Teams, Discord, Mattermost, Zoom, Telegram, Notion and Zoho Mail lose DPAPI-protected keys and session cookies.
• Five cloud sync folders including Google Drive, OneDrive, iCloud, Proton Drive and MEGA get scanned for .txt and .docx files.
• 30+ other software brands have been catalogued across the same threat actor’s domain pool, from Chocolatey to PuTTY.

Remote Keyboard Access After the Sweep

A second module, delivered after the initial inventory, gives the operator hands-on-keyboard access to the compromised machine. That is the pivot from automated credential harvest to human-driven movement inside whatever corporate network the developer happens to be connected to. The same install that promised to write code can now be writing commands an attacker types in real time.

Slack Cookies Beat Phishing Emails

The campaign’s prize is not credit-card data. It is the session cookies a developer’s browser holds for Slack workspaces, Microsoft Teams tenants, GitHub accounts, and corporate SSO portals. Each one is a passwordless entry into the company that pays the developer.

Session cookies bypass multi-factor authentication entirely. An attacker who imports a stolen cookie into their own browser is logged in as the developer, MFA already satisfied, no challenge prompt. Once inside Slack, the operator can read channels, search history for words like password or secret, and post messages from the developer’s identity.

OpenVPN configurations sit in the same payload list, and those configs frequently embed certificate material a worker uses to enter their employer’s internal network. A single developer’s compromise gives the attacker a route to private code repositories, internal staging servers, and database admin consoles without ever needing to crack an external login.

Cryptocurrency holdings get drained on the same pass. The malware reads wallet data from Brave’s built-in wallet and the Spectre desktop wallet, alongside any unencrypted seed phrases in the cloud-sync folders it just enumerated. The pattern echoes earlier supply chain installer compromises, including the DAEMON Tools installer backdoor that reached users in 100+ countries through its official download channel.

A Bulletproof Host and a Stolen Certificate

The infrastructure behind the campaign sits at 109.107.170.111, a Netherlands IP belonging to MIRhosting, which the threat intelligence community has long flagged as a bulletproof provider, meaning a host that does not honor abuse complaints quickly enough to disrupt active operations.

Signing the malicious binaries is an Extended Validation code-signing certificate issued to Shenzhen Xingzhongxing Electronic Technology Co., Ltd. Extended Validation (EV) certificates are the highest trust tier Windows recognizes, and a signed binary passes through SmartScreen without the yellow warning a developer would normally see for an unknown executable. The certificate appears to have been stolen rather than freshly issued, consistent with a wave of EV certificate theft researchers documented earlier this year.

Command-and-control traffic is split across three hosts (vents.msft23.com, events.ms709.com, and mo2307.com) that cosplay as Microsoft and generic update endpoints. The naming is calibrated to survive a quick visual scan of network logs by a junior analyst.

How to Verify an AI CLI Download Before You Paste

The cleanup advice for affected developers is concrete, and the prevention advice applies to the next AI tool launch as much as this one. Anthropic’s coding agent has shipped follow-on updates since its first compromise, which sat next to a separate 512,000-line Claude Code source leak earlier in 2026, so the install surface keeps changing.

1. Bookmark the official source for every CLI tool you use. The canonical URL for Google’s CLI is google-gemini.github.io and for the Anthropic coding agent is docs.anthropic.com. Never reach either through a search engine.
2. Treat any paste this PowerShell or curl pipe bash command as untrusted until you verify the domain serving it. Inspect the URL in the browser bar before pressing enter.
3. Scan downloaded scripts on virustotal.com before execution, and check the SHA-256 of binaries against the publisher’s signed release notes.
4. Rotate session cookies and OAuth tokens for Slack, Microsoft Teams, GitHub and corporate SSO if you have installed any AI CLI in the past 90 days from a non-bookmarked link. Browsers do not invalidate session cookies after a credential refresh.
5. Disable PowerShell script execution where you do not need it. Set-ExecutionPolicy Restricted on workstations that never run scripts removes the entire attack surface this campaign relies on.

If the operator’s pattern holds, every fresh AI CLI release between now and year-end will spawn its own typosquat within days of launch. If Anthropic and Google start publishing signed binaries with reproducible install hashes on their primary domain, that loop closes. If they keep relying on bare npm install instructions, the next compromise is a search-and-paste away.

Frequently Asked Questions

Were Mac and Linux Developers Affected, or Only Windows?

Windows is the primary target because the PowerShell-only payload only runs on Windows. Bitdefender Labs documented related Google Ads campaigns serving macOS-formatted disk images for the same Anthropic-impersonating lure, so Mac developers should treat any non-bookmarked install link with the same suspicion. Linux saw no confirmed payload from this specific operator as of 21 May 2026.

How Do I Check if My Machine Is Already Compromised?

Look for outbound connections to vents.msft23.com, events.ms709.com, or mo2307.com in your firewall or DNS logs over the past 60 days. Check PowerShell event history for invocations of start.ps1 or Install.ps1 from a non-standard path. If any match, assume credential exfiltration occurred and rotate every cookie, token, and password the affected user holds.

Is the Legitimate Gemini CLI or the Real Anthropic Coding Agent Safe to Install?

Yes, when sourced from the publisher’s own domain. The genuine Google CLI installs through npm from google-gemini.github.io documentation, and Anthropic distributes its agent through docs.anthropic.com. Neither tool is compromised at source; only the typosquat install pages are.

Did Google or Anthropic Shut Down the Fake Domains?

EclecticIQ’s report names domains still resolving as of mid-May 2026. Takedowns for typosquat domains typically require a registrar abuse process that can run weeks behind active operation, and the operator simply rotates to a new lookalike when one falls. Google has not publicly acknowledged a delisting timeline for the SEO-poisoned pages.

What if I Ran the PowerShell Command but Caught It Before It Finished?

Assume the credential sweep completed. The malware’s first action is to disable AMSI and ETW, and the data collection phase runs in seconds, not minutes. Even an aborted session likely sent at least the browser cookie store and the first wave of app credentials to the command-and-control endpoint. Rotate everything.