Hackers Abuse Google Search to Attacks ITadmins with Weaponized PuTTY Installer

IT administrators searching Google for PuTTY may see a convincing fake download result mixed with legitimate links. Researchers documented a campaign that uses a lookalike website to deliver a malicious Windows installer disguised as the popular SSH client.

The installer opens a working PuTTY window as a decoy while secretly starting a separate malware chain in the background.

The campaign targets people who use remote access and system tools as part of their work. A poisoned search result leads to a fake PuTTY page, and its download link supplies a trojanized MSI installer.

The page copies the title of the genuine PuTTY download site, helping the fake result seem credible. This method echoes earlier campaigns involving fake PuTTY downloads targeting IT admins, but the newly reported chain uses Node.js and a different command system.

Analysts from Unit 42 identified the campaign and reported that the MSI installs an obfuscated Node.js loader alongside an unmodified, signed PuTTY 0.85 program.

Their findings describe a multi-stage infection that can give an operator the ability to send new JavaScript instructions to an infected computer. The report also notes the use of Ethereum smart contracts to find the active command-and-control, or C2, server.

Hackers Abuse Google Search

The reported delivery site, puty[.]ink, imitates PuTTY’s download page. Clicking its download link retrieves Putty-x86_64.msi from a Backblaze B2 storage bucket.

When a victim opens the installer, Windows Installer drops four files into a folder under the user’s Local AppData directory. The MSI also opens putty.exe, a legitimate, Sectigo-signed copy of PuTTY 0.85. Because the program looks and works normally, a user may believe the installation is safe.

Meanwhile, the installer starts a batch file named 44JYYsqg.cmd. The script hides its console, checks whether Node.js is already installed, and downloads the official Node.js 18.20.5 runtime if it is not.

It then uses a small JScript file to launch Node.js with an obfuscated JavaScript payload. The runtime itself is legitimate; the danger comes from the attacker’s script and the way it is used. This approach resembles other cases where attackers use Node.js as a malware launcher.

Rather than relying only on a fixed server address embedded in the malware, the JavaScript loader queries an Ethereum smart contract through seven public RPC services.

It compares the replies and uses the most common valid URL as its C2 address. The malware checks for an updated address every five minutes, making it harder for defenders to rely on blocking just one server.

The technique, known as EtherHiding, has also appeared in other campaigns that hide malware infrastructure on Ethereum. After finding a server, the malware checks in about every 500 milliseconds.

Its requests resemble downloads of ordinary image or style files, using extensions such as .png, .jpg, .css and .ico.

If the server returns more than 10 bytes, the loader passes the response to JavaScript execution with access to Node.js features. That means the operator can send new capabilities without replacing the original installer.

Why IT teams should take notice

Unit 42’s findings describe commands for collecting system details, including the operating system, antivirus products, domain membership, graphics hardware and active SMB sessions.

The researchers also observed browser-profile and cookie collection, installation of a WebSocket package, and a PowerShell routine that captured roughly five desktop screenshots per second.

Those images were saved as encoded files in the temporary folder, enabling near-live monitoring of the user’s screen. The campaign does not rely on a software flaw in PuTTY.

It depends on a user trusting a search result and running an installer from a fake page. That is especially concerning for administrators, whose computers may hold browser sessions, saved access details or active connections to internal systems.

Similar search-result lures have been used to deliver trojanized utilities, as seen in earlier fake PuTTY and WinSCP campaigns targeting IT teams.

Teams should direct staff to verified software sources and consider maintaining an approved software portal for commonly used tools.

Security teams can investigate unexpected node.exe activity from user AppData folders, especially when it runs with an .ini file argument.

They should also review MSI launches that create the named campaign files, and check for outbound traffic to Ethereum RPC services from computers that have no business using them.

PuTTY’s legitimate download page and Node.js’s official release source can help users verify where trusted software should come from: PuTTY’s official site and Node.js 18.20.5 for Windows.

Unit 42’s campaign announcement is available on X. A familiar program window or a valid signature on one bundled file does not prove that the installer itself is safe.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Abuse Google Search to Attacks ITadmins with Weaponized PuTTY Installer appeared first on Cyber Security News.