EtherRAT Uses SEO Poisoning and Fake GitHub Pages to Target Enterprise Admins

Gbhackers •Mayura Kathir • May 1, 2026

A newly uncovered cyber campaign dubbed “EtherRAT” is raising concerns across enterprise environments, as attackers combine SEO poisoning, GitHub abuse, and blockchain-based infrastructure to target high-privilege IT professionals. Instead of broadly targeting users, the attackers deliberately impersonate trusted administrative tools, increasing the likelihood that victims already have elevated system access. The attack chain begins with […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

EtherRAT Campaign Targets Enterprise Admins via SEO Poisoning and GitHub Abuse The EtherRAT cyber campaign has emerged as a significant threat targeting enterprise administrators, DevOps engineers, and security analysts. Attackers utilize SEO poisoning and fake GitHub pages to deliver malware specifically designed to exploit high-privilege IT professionals. This targeted approach increases the likelihood of successful infiltration, as victims are tricked into downloading malicious software disguised as legitimate tools. The campaign leverages blockchain-based infrastructure, enhancing its sophistication and stealth. Current reports indicate that the attack chain is actively ongoing, with no specific numbers on affected organizations or systems disclosed. The focus on high-privilege users suggests a strategic shift in cyber threats towards more targeted and impactful attacks. Security teams are advised to remain vigilant and review their defenses against such tailored threats. 2 sources 65

Extracted Entities

EtherRAT Uses SEO Poisoning and Fake GitHub Pages to Target Enterprise Admins

The full story

Extracted Entities

Malware (1)

MITRE ATT&CK (1)

Platforms (1)