SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer

Reported 21 May 2026 by otx · Severity: medium

Financially motivated eCrime actors are conducting an ongoing infostealer campaign targeting software developers through SEO poisoning techniques. The operation impersonates AI platforms including Gemini CLI and Claude Code, as well as developer tools like Node.js, Chocolatey, an