A newly reported malware campaign is targeting some of the most valuable users inside enterprise environments: administrators, DevOps engineers, systems engineers, and security analysts.
According to the Atos Threat Research Center, the campaign was identified in March 2026 and uses a combination of SEO poisoning, fake GitHub repositories, malicious MSI installers, and Ethereum-based command-and-control resolution to distribute a remote access trojan known as EtherRAT.
This is not a broad consumer malware campaign. It is built to compromise people who manage infrastructure.
Why This Campaign Is Dangerous
The attackers are impersonating administrative utilities that IT teams use every day, including tools such as:
- 🛠️ PsExec
- 📦 AzCopy
- 🔍 Sysmon
- 🔐 LAPS
- 📊 Kusto Explorer
- 🧪 Process Explorer, TCPView, ProcDump, BgInfo, WinDbg, and others
Atos reported that between early December 2025 and April 1, 2026, the threat actor deployed 44 separate GitHub facade repositories, each spoofing a different administrative or developer tool.
This targeting is highly strategic. A normal user rarely searches for tools like WinDbg, Windows ADK, Sysmon, or Kusto Explorer. But administrators, DevOps engineers, and security teams do.
That means every successful infection is more likely to land on a workstation with elevated access.
SEO Poisoning: The Attack Starts in Search Results
The campaign begins with SEO poisoning.
Attackers manipulate search results on engines such as Bing, Yahoo, DuckDuckGo, and Yandex so that malicious GitHub repositories appear near the top when users search for niche IT tools. Atos observed this approach being used for specialized administrative utilities, including searches for Kusto Explorer and other Windows admin tools.
This is especially effective because GitHub carries a strong trust signal. A professional-looking repository with a clean README can appear credible, especially when it ranks highly in search results.
The Two-Stage GitHub Facade Trick
The distribution architecture is clever.
The first GitHub repository acts as a facade. It is SEO-optimized and looks professional, but it does not directly host malware. Instead, it contains a README that points users to a second GitHub repository.
That second repository is the real payload delivery location.
This separation makes the campaign more resilient. If the malicious payload repository is removed, the attackers can simply update the link in the clean facade repository. The SEO-ranked storefront stays alive, while the malware-hosting backend can be rotated.
In simple terms:
Search result
↓
Clean-looking GitHub facade
↓
README link
↓
Hidden GitHub payload repository
↓
Malicious MSI installer
↓
EtherRAT infection
This is a strong reminder that a GitHub page is not automatically trustworthy just because it looks clean.
Malicious MSI Installers Disguised as Trusted Tools
The malware is delivered as an MSI installer pretending to be a legitimate administrative utility.
This matters because MSI packages often feel more trustworthy than random scripts or suspicious executables. For administrators, installing utilities is also part of normal daily work.
Atos describes the malware as a multi-stage, fileless-style JavaScript RAT delivered through malicious MSI installers. The latest variant uses multiple stages, AES-256-CBC encryption, a blockchain-based dead-drop resolver, and runtime execution through Node.js.
Notably, Node.js is downloaded at runtime from the official Node.js distribution site rather than bundled inside the malware package. This helps keep the installer smaller and allows the malware to rely on legitimate infrastructure during execution.
How the Malware Chain Works
At a high level, the infection chain looks like this:
1. 🧾 Stage 0 — Obfuscated CMD Dropper
The MSI launches a heavily obfuscated .cmd script through a Custom Action. This script runs with elevated privileges, hides its execution, creates a staging directory under %LOCALAPPDATA%, downloads Node.js, extracts it, and launches the next stage.
2. 🧠 Stage 1 — In-Memory Loader
The first Node.js stage reads and decrypts the next payload, then executes it in memory using Node.js module loading. This reduces obvious disk artifacts and helps avoid simple static detection.
3. 🪝 Stage 2 — Persistence Loader
The second stage decrypts the main RAT payload, writes it under a random-looking filename, and executes it through node.exe wrapped by conhost.exe --headless. It also creates persistence using the Windows Run registry key.
4. 🐀 Stage 3 — EtherRAT
The final payload is the main RAT. It runs silently in the background, assigns the infected machine a unique bot ID, resolves its command-and-control address through Ethereum, polls for attacker commands, and can execute arbitrary JavaScript inside the running Node.js process.
Ethereum-Based Command and Control
The most interesting technical feature is the use of Ethereum smart contracts for command-and-control resolution.
Instead of hardcoding a C2 domain or IP address, the malware queries a specific Ethereum smart contract to retrieve the current live C2 address. Atos describes this as Blockchain-based Dead Drop Resolving.
This gives the attacker two major advantages:
- 🔁 Infrastructure agility — the attacker can rotate C2 servers by updating the value stored in the smart contract.
- 🛡️ Resilience — as long as public Ethereum RPC gateways are reachable, infected machines can continue finding the attacker-controlled backend.
Atos also reported that the RAT queries nine public Ethereum API services in parallel and uses the majority response, making the resolution process more reliable even if some services are unavailable. The malware repeats this blockchain lookup every five minutes, allowing it to automatically switch to a new C2 address after the attacker updates the contract.
Why Blockchain C2 Is Hard to Disrupt
Traditional takedown methods focus on domains, IP addresses, hosting providers, and DNS records.
This campaign changes the problem.
The C2 location is not only stored in attacker infrastructure. It is resolved through the blockchain state. That means blocking a single domain or taking down a server may not be enough, because the malware can be redirected to new infrastructure through one on-chain update.
Sysdig previously documented EtherRAT as an implant using Ethereum smart contracts for C2 resolution, noting that this approach differs from more common malware using hardcoded IPs or domains. Sysdig also reported overlaps with North Korea-linked Contagious Interview tooling, while Atos references those earlier findings in its own analysis.
Not Just a Fast Stealer Campaign
Atos stresses that this activity does not behave like a typical high-speed commodity stealer campaign.
Instead of immediately blasting the environment with noisy scans, the attackers appear to prioritize stealth, persistence, and methodical discovery after initial access. Atos observed hands-on-keyboard activity and quiet mapping of high-privilege enterprise architecture.
That makes this campaign particularly concerning. The objective appears to be long-term strategic access, not just quick data theft.
The “Irony Lure” Against Security Teams
One of the most aggressive parts of this campaign is psychological.
The attackers are impersonating tools that defenders may use during investigations. A security analyst searching for Process Explorer, TCPView, Sysmon, or ProcDump could unknowingly download malware while trying to investigate a problem.
That creates an “irony lure”: the very act of preparing to defend or diagnose the environment becomes the infection path.
This is why tool provenance matters. For administrative software, search engines should not be treated as the source of truth.
Defensive Recommendations
Organizations should treat this campaign as a warning about how privileged users obtain software.
Recommended actions:
Lock down admin tool sourcing
Administrators and security teams should download tools only from:
- official vendor portals
- authenticated internal software catalogs
- managed package repositories
- approved endpoint management systems
Avoid downloading administrative tools from search-result links, even if the result points to GitHub.
Review historical traffic
Security teams should review logs for:
- outbound connections to public Ethereum RPC endpoints
- known EtherRAT C2 domains and infrastructure
- suspicious traffic patterns to unusual external web assets
- periodic blockchain lookups from admin workstations
Atos recommends retrospective log review for communications with listed Ethereum RPC endpoints and historical C2 domains.
Hunt suspicious process behavior
Focus on behavior rather than filenames, because the campaign randomizes names and extensions.
Useful hunting patterns include:
node.exeexecuting shell commandsconhost.exelaunched with--headless- persistence under
HKCU\Software\Microsoft\Windows\CurrentVersion\Run - Node.js executing from unusual directories under
%LOCALAPPDATA% - suspicious repeated beacons to external domains
- periodic requests to public Ethereum RPC services
Atos specifically highlights high-frequency beacons, five-minute Ethereum RPC lookups, suspicious node.exe process trees, and conhost.exe --headless usage as hunting opportunities.
Restrict decentralized infrastructure where appropriate
Where there is no legitimate business need, organizations should consider blocking or tightly monitoring public Ethereum RPC endpoints from enterprise workstations.
This should be done carefully to avoid disrupting legitimate blockchain-related business workflows, but in most corporate admin environments, direct access to public Ethereum RPC gateways is unusual.
Monitor privileged workstations more closely
Because the campaign targets administrators, DevOps engineers, and security staff, organizations should treat privileged workstations as high-value assets.
Recommended controls include:
- application control
- EDR with script and Node.js visibility
- PowerShell and command-line logging
- browser download monitoring
- software allowlisting
- privileged access workstations for sensitive admin tasks
- strong separation between daily browsing and administrative operations
Key Message for IT Teams
This campaign shows that attackers understand how administrators work.
They know that IT staff search for tools. They know GitHub looks trustworthy. They know MSI installers appear professional. They know security teams rely on Sysinternals-style utilities. And they know that compromising one admin workstation can open the door to an entire enterprise.
The lesson is clear:
🔐 For admin tools, trust must come from provenance — not search ranking.
A top search result, a clean README, or a familiar tool name is not enough.
Final Thoughts
The EtherRAT administrative utility spoofing campaign combines several modern attacker techniques into one resilient operation:
- 🔎 SEO poisoning
- 🧱 clean GitHub facade repositories
- 🧨 malicious MSI installers
- 🧬 multi-stage JavaScript malware
- ⛓️ Ethereum smart contract C2 resolution
- 🕵️ stealthy post-compromise behavior
- 🎯 targeting of high-privilege IT users
This is not just another fake-download campaign. It is a targeted attempt to compromise the people who manage enterprise infrastructure.
Organizations should respond by tightening how administrative tools are sourced, improving detection around Node.js and suspicious process chains, monitoring Ethereum RPC usage, and educating IT teams that search results are now part of the attack surface.
