HiddenGh0st, Winos and kkRAT Exploit SEO, GitHub Pages in Chinese Malware Attacks

Chinese-speaking users are the target of an SEO poisoning campaign that uses fake software sites and Google search manipulation to deliver malware, according to Fortinet FortiGuard Labs researcher Pei Han Liao. The activity, discovered in August 2025, leads to the deployment of malware families such as HiddenGh0st and Winos (aka ValleyRAT), both variants of Gh0st RAT.

Attackers redirect users searching for tools from legitimate pages to spoofed sites via trojanized installers, with a script named nice.js controlling the delivery chain through multiple JSON links that culminate in the final malicious installer. The installer contains a malicious DLL (EnumW.dll) that performs anti-analysis checks and attempts to unpack a second DLL (vstdlib.dll) to launch the main payload, while also checking for 360 Total Security and using TypeLib COM hijacking to achieve persistence.

If antivirus is present, the campaign can still sideload a DLL (AIDE.dll) to enable C2, heartbeat, and monitor functions; and it can replace cryptocurrency wallet addresses and hijack wallets via various plugins, with Winos previously linked to the Silver Fox group.