Cybersecurity Threat Advisory: Fake PuTTY Downloads Are Hunting Your IT Admins

Threat update

Attackers are using poisoned Google search results and sponsored ads to steer IT administrators to fake PuTTY download sites. The installer looks right, and PuTTY even opens and works like normal. Meanwhile, malware is quietly installing itself in the background, stealing browser sessions and credentials, and watching the admin's screen. No software flaw is involved. The attack only needs one busy admin to click the first search result. If your team ever grabs tools from a quick Google search, now is the time to put a stop to it. 

Technical Detail and Additional Info

What is the threat?

PuTTY is a free, widely used SSH and Telnet client that IT teams rely on every day to manage servers, firewalls, switches, and other network gear. Researchers at Palo Alto Networks' Unit 42 reported a campaign in October 2026 that turns that everyday habit into an entry point. Here's how it plays out:

• The lure: A search for "PuTTY download" can surface a sponsored or poisoned result pointing to a lookalike site, such as puty[.]ink, that copies the title of the real PuTTY page. A redirect domain, putredirhelps[.]online, helps move victims along.
• The download: The victim gets a file named Putty-x86_64.msi, hosted in a Backblaze B2 cloud storage bucket.
• The decoy: The installer drops a genuine, unmodified, Sectigo-signed copy of PuTTY 0.85 and opens it. Everything looks normal, so the admin gets back to work.
• The hidden chain: At the same time, the installer drops a batch file, a small JScript launcher, and an obfuscated JavaScript payload into a randomly named folder under the user's AppData\Local directory. If Node.js isn't already on the machine, the script downloads the legitimate Node.js 18.20.5 runtime and uses it to run the malware. Using a trusted interpreter this way makes the activity harder for security tools to flag.
• Blockchain-based command and control: Instead of hardcoding a server address, the malware reads its command-and-control (C2) address from an Ethereum smart contract, a technique known as "EtherHiding." It checks seven public Ethereum services and refreshes about every five minutes. That means the attackers can swap servers whenever they want, and blocking a single domain won't cut them off.
• Disguised traffic: The malware checks in about twice a second, with requests made to look like ordinary image or stylesheet downloads (.png, .jpg, .css, .ico). Any response the attacker sends back is run as code, so they can push new capabilities at any time.

Once it's running, the malware has been seen collecting system details (Windows version, antivirus products, domain membership, active SMB sessions), stealing browser profiles and session cookies, and running a PowerShell routine that captures about five screenshots per second for near-live monitoring of the admin's desktop. 

Why is it noteworthy?

This one goes straight for the people with the keys to everything. IT administrators have privileged access to servers, databases, cloud consoles, and network infrastructure. Their workstations hold saved credentials, SSH keys, and logged-in browser sessions that can be worth more to an attacker than an entire department's mailboxes.

It also skips the usual warning signs. There's no suspicious email to report and no strange attachment. The malware arrives through Google, a platform people trust, and the victim ends up with a PuTTY window that works exactly as expected. The signed PuTTY file inside the package is legitimate, which is a good reminder that one signed file doesn't make the whole installer safe.

This isn't new territory, either. Attackers have used fake PuTTY and WinSCP downloads before, including a 2024 ransomware campaign and a 2025 SEO poisoning wave that delivered the Oyster backdoor. They keep coming back to this lure because it keeps working. 

What is the exposure or risk?

Organizations face the most risk when:

• IT staff download admin tools from search results instead of official sources or an approved internal repository
• Users, especially admins, can install software freely without application control or allowlisting
• Admins do day-to-day browsing on the same machine and account they use for privileged work
• Admin accounts don't require MFA, or credentials and SSH keys are stored on workstations
• Endpoint protection and ad-blocking aren't in place, or no one is watching endpoint alerts

If attackers get in, they could:

• Steal passwords, SSH keys, and session cookies, letting them log in as the admin and bypass MFA on already-authenticated sessions
• Watch the admin's screen in near real time and capture sensitive information as it's typed or displayed
• Move laterally to servers and network devices, escalate privileges, and work toward a domain-wide compromise
• Deploy ransomware, steal data, or plant persistent backdoors
• Keep control even after you block a known C2 server, thanks to the blockchain-based address lookup

What are the recommendations?

LBT Technology Group recommends the following actions:

• Only download admin tools from the source. Get PuTTY from the developer's official page (chiark.greenend.org.uk/~sgtatham/putty) or a trusted, internally managed repository. Skip sponsored search results entirely, and bookmark the official sites your team uses most.
• Verify before you install. Check digital signatures and published checksums on the installer itself, not just the files inside it.
• Control what can be installed. Use application allowlisting and endpoint protection, and consider an approved internal software portal so nobody has to search for tools in the first place. Ad-blocking on admin workstations removes much of the malvertising risk.
• Separate admin work from everyday browsing. Use dedicated admin accounts or workstations, enforce least privilege, and require MFA on every administrative account.
• Hunt for signs of this campaign. Watch for node.exe running from user AppData folders (especially with an .ini file argument), msiexec.exe launching cmd.exe, hidden wscript.exe activity, and outbound traffic to Ethereum RPC services from machines with no business reason to use them. Block the known domains (puty[.]ink, putredirhelps[.]online, presanis[.]com).
• Act fast if you find something. Isolate the machine, then rotate every password, SSH key, API key, and token that was stored on or used from it. Sign out active browser and cloud sessions so stolen cookies stop working.
• Train your technical staff, too. IT teams are often left out of security awareness training. Make sure they know how malicious search ads work and how to verify software before installing it.

Not sure how your team gets its tools, or what an attacker could reach from an admin's laptop? Contact LBT Technology Group for a no-pressure review of your endpoint and privileged access security.

References

 For more in-depth information about the recommendations, please visit the following links:

• Dutta, Tushar Subhra. "Hackers Abuse Google Search to Attacks IT Admins with Weaponized PuTTY Installer." Cyber Security News, October 14, 2026.
• Kathir, Mayura. "Hackers Target PuTTY Users With SEO Poisoning and Ethereum-Powered Malware." GBHackers News, October 14, 2026.
• Intrucept Labs. "SEO Poisoning Campaign Targets IT Admins with Weaponized PuTTY & WinSCP." July 2025.