HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks
A search engine optimization (SEO) poisoning effort targets Chinese-speaking people by disseminating malware through phony software websites.
According to Pei Han Liao, a researcher at Fortinet FortiGuard Labs, the attackers used SEO plugins and registered lookalike domains that closely resembled genuine software websites to influence search rankings. They deceived victims into accessing spoof websites and downloading malware by exploiting subtle character changes and persuasive wording.
The cybersecurity firm noticed the activity in August 2025. It results in the distribution of malware families such as HiddenGh0st and Winos (also known as ValleyRAT), which are both variations of the remote access trojan Gh0st RAT.
Notably, the use of Winos has been linked to a cybercrime group ...