SEO Poisoning Campaign Targets 8,500+ SMB Users with Malware Disguised as AI Tools
Upon execution, a backdoor known as Oyster/Broomstick is installed. Persistence is established by creating a scheduled task that runs every three minutes, executing a malicious DLL (twain_96.dll) via rundll32.exe using the DllRegisterServer export.