Fake PuTTY in Google Search: How Attackers Trick IT Admins with a Trojanized Installer
IT administrators hunting for a trusted SSH client on Google can be lured to a convincing fake download page that drops a trojanized installer. The malicious MSI appears to install the legitimate PuTTY executable so the program opens and looks normal, while a stealthy Node.js-based loader runs in the background and connects to attacker-controlled infrastructure. Because the visible application behaves as expected and the bundled PuTTY binary is signed, many…