Executive Summary
A sophisticated SEO poisoning campaign is targeting users of the DeepSeek AI tool by promoting malicious lookalike domains in search engine results. When users attempt to download software from sites like deepseekcn[.]cyou, they receive weaponized ZIP archives that initiate a multi-stage execution chain involving MSI installers, shellcode injection, and DLL side-loading. The campaign is believed to be a continuation of activity first observed in early 2026 targeting Chinese-speaking developers.
Technically, the attack uses a legitimate 'Cyglaunch' executable to side-load a malicious DLL, which then establishes persistence and downloads the final Kong RAT payload. The malware includes advanced features for credential theft, including a keylogger and clipboard monitoring, and maintains persistence by modifying the Windows Userinit registry key. Attribution to a Chinese-affiliated actor is suspected due to PDB paths referencing the Chinese cybersecurity forum '52pojie' and targeting patterns.
This campaign poses a significant risk to organizations whose employees utilize AI tools or developer utilities. The multi-stage nature and use of legitimate signed components are designed to bypass traditional perimeter defenses, resulting in long-term persistence and data exfiltration through keylogging and custom C2 protocols.