EtherRAT Campaign Uses SEO Poisoning and GitHub Facades to Target Enterprise Admins

Cybersecuritynews •Tushar Subhra Dutta • May 1, 2026

A new and well-planned malware campaign has been actively targeting enterprise administrators, DevOps engineers, and security analysts by hijacking their everyday habits. Rather than using mass phishing or broad spam waves, threat actors behind this operation have carefully crafted a delivery chain that puts dangerous software directly in front of high-privilege IT professionals when […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

EtherRAT Campaign Targets Enterprise Admins via SEO Poisoning and GitHub Abuse The EtherRAT cyber campaign has emerged as a significant threat targeting enterprise administrators, DevOps engineers, and security analysts. Attackers utilize SEO poisoning and fake GitHub pages to deliver malware specifically designed to exploit high-privilege IT professionals. This targeted approach increases the likelihood of successful infiltration, as victims are tricked into downloading malicious software disguised as legitimate tools. The campaign leverages blockchain-based infrastructure, enhancing its sophistication and stealth. Current reports indicate that the attack chain is actively ongoing, with no specific numbers on affected organizations or systems disclosed. The focus on high-privilege users suggests a strategic shift in cyber threats towards more targeted and impactful attacks. Security teams are advised to remain vigilant and review their defenses against such tailored threats. 2 sources 65

Extracted Entities

EtherRAT Campaign Uses SEO Poisoning and GitHub Facades to Target Enterprise Admins

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)