SEO Poisoning Attack Delivers Oyster Malware via Fake PuTTY & WinSCP Downloads
A stealthy, large-scale campaign, discovered in June 2025, utilized malicious ads and built-in SEO poisoning to distribute the Oyster (also known as Broomstick or CleanUpLoader) backdoor. The attackers trojanized legitimate IT tools, specifically PuTTY and WinSCP, to deliver malware through seemingly trusted installers. These deceptive sites mimicked official download pages, luring IT professionals and system admins searching online into running compromised installers.
Once executed, the malware establishes persistence by installing a DLL (twain_96.dll) and registering scheduled tasks that run every three minutes via rundll32.exe using DLL registration tricks for stealth. With Oyster onboard, actors gain remote access, steal credentials, execute code, and deploy further malicious payloads, posing a heightened risk within enterprise environments.
Security teams are urged to avoid downloading administrative tools from search engine results or sponsored ads. Instead, download only from official vendor sites or internal repositories. Additionally, the block identified malicious domains such as updaterputty.com, puttyy.org, putty.run, and zephyrhype.com to minimize exposure.
Comments
Post a Comment