Attackers Are Gaming Google's Top Results to Serve You Malware. It's Called SEO Poisoning

In April, a security researcher who posts as @g0njxa noticed something on Google.

Search for Gemini CLI — Google's own AI coding tool — and the top result wasn't Google's. It was geminicli[.]co[.]com, sitting directly above geminicli.com. Nearly identical page. Same layout, same branding, same install instructions.

Look at that domain again. Not .com. Not .co.uk. .co.com — a real, purchasable domain suffix that reads, to a person scanning quickly, exactly like the thing they were looking for.

EclecticIQ later traced the campaign back to early March 2026, and found a companion operation impersonating Anthropic's Claude Code. The targets weren't grandparents falling for a Facebook scam. They were software developers, on Windows workstations, with corporate VPN credentials, OAuth tokens and CI/CD keys sitting in their browsers.

They got to the top of Google by doing SEO. Not by hacking anything.

The dark mirror of your job

Here's the part that should interest anyone who works in search: the attackers use your toolkit.

They research keywords that get significant volume but have low competition — software downloads, driver updates, activation cracks, "how to install X," urgent system fixes. They use Google Trends, Ahrefs, Semrush. They register lookalike domains. They build out pages. They rank.

That's it. That's the whole exploit. No zero-day, no phishing email, no vulnerability. The attack surface is a habit: over 25% of people click the first Google result, and almost nobody reads the URL before they do.

SEO poisoning doesn't defeat your security stack. It rides in through the front door, on organic behaviour, in the one moment of the day when you have deliberately decided to trust Google.

Four campaigns running right now

Fake VPN clients (Storm-2561). Microsoft Defender Experts caught this in mid-January and published in March. Users searching for legitimate enterprise VPN software got redirected to spoofed sites, then to a GitHub repo hosting a fake client. The installer was digitally signed — which reduces security alerts and lends the whole thing false legitimacy. Microsoft attributes it to Storm-2561, a financially motivated actor active since May 2025 and known for exactly this.

Poisoned PC utilities. Microsoft documented a cryptojacking operation in May impersonating CrystalDiskInfo, HWMonitor, Display Driver Uninstaller, FurMark, K-Lite Codec Pack and PDFgear. The brand list isn't random. Every one of those is beloved by PC enthusiasts — precisely the people who own a high-end discrete GPU, which is the hardware that makes mining worth doing. The targeting is in the keyword selection.

A 90-domain, 10-language operation. Kaspersky reported this two weeks ago: a massive multi-domain campaign spoofing OBS Studio, DNS Jumper, DS4Windows and Bandicam, across English, Russian, Chinese, German, French, Spanish, Portuguese and Arabic. Some domains were registered between August 2025 and March 2026 — meaning they were aging quietly for months before they were used. That's an SEO tactic, not a security one.

Fake AI tool installers. The Gemini CLI and Claude Code campaigns above. EclecticIQ's read is that financially motivated crews are deliberately capitalising on enterprise AI adoption, because the person installing a new AI coding tool has exactly the credentials worth stealing.

Why "but it worked fine" means nothing

This is the single most important thing in this article, so read it twice.

The fake installer usually installs the real software too.

In the Gemini CLI campaign, the malicious script did two things at once. It quietly fetched its payload, and in parallel it ran the genuine npm install command that pulls the real Gemini CLI from Google's official registry. You get the tool. It works. Nothing looks wrong.

The Storm-2561 VPN campaign went further, and it's genuinely the most chilling detail in any of this. After capturing your credentials, the fake client shows a convincing installation-failure error — and then helpfully gives you instructions for downloading the legitimate VPN client from official sources. In some cases it opens your browser to the real vendor's website for you.

So you install the real one. It works. You shrug, blame a flaky download, and get on with your day. Microsoft's assessment is explicit: if the legitimate VPN then connects normally, there are no indications of compromise visible to the end user.

The malware helps you fix the problem it pretended to have, so that you stop investigating.

Your software working is not evidence that you weren't robbed.

The red flag that catches most of them

There's one pattern that shows up across nearly every recent campaign, and it has a name: ClickFix.

The fake page tells you to complete installation by copying a command and pasting it somewhere — PowerShell, Command Prompt, Terminal, or the Windows Run dialog (Win+R). It's framed as a routine setup step. It looks like the kind of thing developers do all day.

Cyderes' analysis of a spoofed Claude Code install page put the problem plainly: the victim isn't a careless admin ignoring policy. It's someone excited about a new tool, following instructions that look completely legitimate, who has no baseline for what a correct installation should look like. There's no alarm because nothing feels wrong.

Now, the honest caveat that most security write-ups skip: some legitimate developer tools genuinely do use install commands you paste into a terminal. That's real. So "never paste a command" is wrong advice, and if we told you that, you'd ignore all of it.

Here's the version that actually works:

The command is only as trustworthy as the page you got it from — and a search result is not a source.

If you found the instruction by clicking a link from Google, you have no idea whose command it is. If you typed the vendor's domain yourself, or you're reading their documentation on a domain you've verified, that's a different situation entirely.

The lure isn't the command. The lure is arriving at the page via search.

It's not just Google anymore

In April, Microsoft observed reports that users were being directed to malicious domains through interactions with LLM-based tools.

Microsoft is careful here, and so should we be: the observation is based on correlated data, they say it's consistent with emerging techniques rather than proven at scale, and they're explicit that it doesn't indicate a systemic problem with any specific AI service.

But the direction is obvious once you say it out loud. If an AI assistant retrieves from the web, and attackers can rank in the web, then attackers can influence what the assistant hands you — with the citation stripped of the visual cues you'd have used to catch it. No URL to squint at. No "sponsored" label. Just a helpful-sounding sentence with a link.

Everything in this article applies there too, minus your ability to see the domain before you click.

What to actually do

Type the domain. For anything you're downloading, go direct — type the vendor's address, or use their official package registry, or use a bookmark you made when you were paying attention. Search is a discovery tool. It is not an authentication mechanism.

Read the whole URL, backwards. The trick lives at the end, not the start. geminicli.co.com looks fine until you notice which two letters are doing the work. Attackers in these campaigns favoured suffixes like .co.com, .us.com and .us.org — chosen, EclecticIQ suggests, to look native to US and UK users.

Distrust the ad slot equally. Attackers buy sponsored placements too. The top of the page is the most contested real estate on the internet; that's what makes it dangerous.

Treat a failed install as a security event. Given the Storm-2561 pattern, an installer that fails and then politely redirects you to the official site is not a minor annoyance. It's a documented tactic.

If you're an org: your IT team is the target. Not the finance department. Admins and developers search for drivers, tools, libraries and troubleshooting guides constantly, from machines with the keys to everything. That's the whole reason these campaigns pick the keywords they pick.

Rotate, don't just clean. These payloads take session cookies and OAuth tokens, not only passwords. Removing the malware doesn't invalidate a stolen session.

The uncomfortable summary

Every defence the search industry built over twenty years assumed the adversary wanted your money through advertising. SEO poisoning is what happens when someone applies the same discipline — keyword research, domain aging, content quality, ranking — and the conversion event is a credential theft.

They're not breaking search. They're using it correctly. That's what makes it hard.