Hackers Abuse Google Search to Distribute Malicious PuTTY Installer
Attackers are leveraging Google Search results to trick IT administrators into downloading a trojanized PuTTY installer, which uses Node.js and Ethereum smart contracts for command and control.
A sophisticated campaign is actively targeting IT administrators by manipulating Google Search results to distribute a malicious installer disguised as the popular PuTTY SSH client. Researchers from Unit 42 have identified that attackers are using a convincing lookalike website, puty[.]ink, which mimics the legitimate PuTTY download page. This deceptive tactic aims to lure unsuspecting users into downloading a trojanized MSI installer that, while appearing to install a functional PuTTY application, secretly initiates a multi-stage malware chain.
The malicious installer, named Putty-x86_64.msi, is hosted on a Backblaze B2 storage bucket. Upon execution, it installs an obfuscated Node.js loader alongside a legitimate, signed copy of PuTTY 0.85. This decoy application functions normally, providing a false sense of security to the user. However, in the background, a batch file (44JYYsqg.cmd) is executed. This script hides its console window and checks for the presence of Node.js, downloading and installing version 18.20.5 if it's not found.
The core of the malware's command and control (C2) infrastructure is where the campaign exhibits its most novel approach. Instead of relying on hardcoded server addresses, the Node.js loader queries an Ethereum smart contract through multiple public RPC services. By analyzing the responses, the malware identifies the most common valid URL, which then serves as its C2 address. This technique, dubbed EtherHiding, has been observed in other campaigns that leverage blockchain technology to create resilient and dynamic C2 infrastructure, making it significantly harder for defenders to block or track.
Once the C2 server is established, the malware communicates with it frequently, checking in approximately every 500 milliseconds. Its requests are disguised as routine file downloads, using common image and style file extensions like .png, .jpg, .css, and .ico. If the server responds with more than 10 bytes of data, the loader interprets this as a command and executes it using JavaScript, granting the attacker the ability to remotely control the infected system without needing to update the initial installer.
The capabilities delivered via these JavaScript commands are extensive and concerning for IT administrators. Researchers observed functionalities for comprehensive system reconnaissance, including the collection of operating system details, installed antivirus products, domain membership, graphics hardware information, and active SMB sessions. Furthermore, the malware is capable of exfiltrating browser profiles and cookies, installing a WebSocket package, and even capturing desktop screenshots at a rate of approximately five per second.
These captured screenshots are encoded and saved in the temporary folder, enabling near-live monitoring of the user's screen. This level of access is particularly dangerous when targeting IT administrators, whose machines often contain sensitive credentials, active connections to internal systems, and access to critical infrastructure. The campaign's reliance on social engineering and deceptive search results, rather than exploiting a software vulnerability in PuTTY itself, highlights the persistent threat of supply chain and distribution attacks.
Security teams are advised to educate users about verifying software sources and to consider implementing approved software portals for essential tools. Technical indicators for detection include monitoring for unexpected node.exe activity originating from user AppData folders, investigating MSI installations that create the described campaign files, and scrutinizing outbound network traffic to Ethereum RPC services from systems that should not be accessing them. The use of a legitimate-looking PuTTY window or a valid signature on bundled files should not be mistaken for a sign of a safe installation.