Bumblebee SEO Poisoning MSI Delivery via /Get?q= on Lookalike Domain

Duo Tech@duotech

•updated Jun 29, 2026•0•0•2

Detects HTTP GET requests to known malicious infrastructure used in SEO poisoning campaigns to distribute the Bumblebee malware loader. The rule monitors for specific URL paths and hostnames associated with lookalike domains delivering trojanized MSI files.