All Detections

Fake Gemini CLI and Claude Code Installer Campaign IOCs

avatar
Kaung Khant Ko@kaungkhantko
updated May 25, 2026210351

Detects network connections to typo-squatted lure domains, payload hosts, and C2 servers associated with the fake Gemini CLI and Claude Code campaign.

Microsoft Sentinel (KQL)