Hackers Use SEO Poisoning to Fake Gemini CLI, Claude Installers

Financially motivated threat actors are running an active campaign that impersonates Google’s Gemini CLI and Anthropic’s Claude Code, using SEO poisoning to deliver a fileless PowerShell infostealer to developer workstations worldwide. First identified in early March 2026 by EclecticIQ researchers,... Read more → The post Hackers Use SEO Poisoning to Fake Gemini CLI, Claude Installers appeared first on IT Security News .
2026-05-23 08:31:59