Published on October 14, 2026
Hackers Abuse Google Search to Attacks IT Admins with Weaponized PuTTY Installer
Severity
Medium
Detail
Security researchers have identified a malicious campaign that abuses Google search results to distribute a trojanized version of the popular PuTTY SSH client. The campaign specifically targets IT administrators and technical personnel who routinely use remote access and system management tools.
Victims searching for PuTTY may encounter a convincing fake website designed to mimic the legitimate PuTTY download page. The malicious site distributes a weaponized MSI installer that presents a legitimate and fully functional copy of PuTTY to the user while secretly deploying malware in the background.
Researchers from Unit 42 reported that the installer contains an authentic, signed copy of PuTTY 0.85 alongside an obfuscated Node.js-based malware loader. This approach allows the software to appear legitimate while establishing a covert infection chain.
Malware employs a multi-stage architecture that enables threat actors to remotely deliver and execute JavaScript-based payloads on infected systems. Instead of relying on fixed command-and-control (C2) infrastructure, the malware leverages an Ethereum smart contract to dynamically retrieve active C2 addresses, making detection and infrastructure takedown significantly more difficult.
How?
The attack begins when a victim searches for PuTTY through Google and clicks on a malicious search result leading to the fake website puty[.]ink, which closely imitates the legitimate PuTTY download page. The site delivers a trojanized installer named Putty-x86_64.msi, hosted on a Backblaze B2 storage bucket. Because the website and installer appear legitimate, victims may not suspect any malicious activity.
When the installer is executed, it installs a genuine, Sectigo-signed copy of PuTTY 0.85, which launches and functions normally as a decoy. At the same time, the MSI package silently creates several malicious files within a hidden directory under the user’s AppData folder and executes a batch loader named 44JYYsqg[.]cmd. The script checks whether Node[.]js is present on the system and, if necessary, downloads the legitimate Node[.]js 18.20.5 runtime from the official source.
The malware then uses an obfuscated JavaScript loader to execute malicious code through Node.js. Instead of relying on a hardcoded command-and-control server, the malware queries an Ethereum smart contract through multiple public Ethereum RPC services. By comparing the responses received, it dynamically retrieves the currently active command-and-control server, making the infrastructure more resilient and difficult to block.
Once the command-and-control server is identified, the malware periodically communicates with it using URLs disguised as requests for common image and stylesheet files, such as .png, .jpg, .gif, .css, and .ico resources. If the server returns a valid response, the malware executes attacker-supplied JavaScript code with full access to Node.js functionality, enabling the deployment of additional payloads without requiring the original installer to be updated.
Researchers observed the malware collecting extensive system information, including operating system details, domain membership, antivirus products, browser profiles, cookies, active SMB sessions, and graphics hardware information. The malware was also capable of capturing screenshots at a high frequency, allowing threat actors to monitor victim activity and gather sensitive information for further exploitation.
Indicators of Compromise (IoCs)
The following indicators of compromise have been associated with this activity.
| Type | Indicator | Description |
| Domain | puty[.]ink | Fake PuTTY download website |
| Domain | putredirhelps[.]online | Redirect domain used in the campaign |
| Domain | presanis[.]com | Observed fallback C2 server |
| File Name | Putty-x86_64.msi | Trojanized PuTTY installer |
| File Name | 44JYYsqg[.]cmd | Batch loader script |
| File Name | BdbEinqaL7[.]js | Obfuscated JavaScript loader |
| File Name | k3TjneJGcwI7[.]ini | Malware configuration file |
| Directory | C:\Users\\AppData\Local\idejDHjFnNXb\ | Malware staging directory |
| Process | node[.]exe | node[.]exe runtime abused to execute malware |
| Network | mnb61ak51 | Observed Backblaze storage bucket |
| Network | execute-api-style C2 requests | Fake image and stylesheet requests used for communications |
| Ethereum Contract | 0x89F5664d6fD8d990FA04F53253Be4855ed481A74 | Smart contract used for C2 discovery |
| Campaign ID | 1835187f-121a-4103-832f-24649a461cac | Campaign build identifier |
| RPC Endpoint | mainnet.gateway.tenderly[.]co | Ethereum RPC service |
| RPC Endpoint | rpc.flashbots[.]net | Ethereum RPC service |
| RPC Endpoint | rpc.mevblocker[.]io | Ethereum RPC service |
| RPC Endpoint | eth-mainnet.public.blastapi[.]io | Ethereum RPC service |
| RPC Endpoint | ethereum-rpc.publicnode[.]com | Ethereum RPC service |
| RPC Endpoint | eth.drpc[.]org | Ethereum RPC service |
| RPC Endpoint | eth.merkle[.]io | Ethereum RPC service |
| SHA-256 | b59d9c911f11ddbe5ac0cd7e2e6e311093a44ac31453b5cab801c31f6a170750 | Malicious MSI installer |
| SHA-256 | 71049ac72adad0c0c4c7a0763a4a9c806ba0687e7146237174d6252b45fb39db | Batch loader |
| SHA-256 | d5197f58b4c2d760f61f7cf0ff9e2a78fcaade12a05057d6e33e8e84c3be084d | JScript launcher |
| SHA-256 | cbc1f7909cb2460e4fb371f3159ea00a167eb4feefea2011f1f6eae3a3449ec6 | JavaScript payload |
Conclusion
This campaign demonstrates a growing trend in which threat actors abuse trusted administrative tools and legitimate software components to compromise enterprise environments. By leveraging search-engine poisoning, fake software download portals, legitimate signed applications, Node.js runtimes, and Ethereum-based infrastructure discovery, attackers can establish persistent and stealthy access while minimizing detection opportunities.
The campaign is particularly concerning because it targets IT administrators, whose systems often have privileged access to enterprise resources. A successful compromise could expose credentials, remote-access sessions, browser-stored secrets, and critical infrastructure management capabilities. Organizations should educate employees to obtain software exclusively from verified vendor sources, maintain approved software repositories for commonly used administrative tools, monitor for unexpected Node.js execution from AppData directories, investigate suspicious MSI installations, and review outbound connections to Ethereum RPC services that are not business-related. Enhanced monitoring of browser credential access, screenshot capture activity, and unusual Node.js processes can help detect similar threats at an early stage.
Source