Author: Vlad Pasca
Executive Summary
SEO poisoning campaign targets DeepSeek AI tool searchers through first-page malicious domains.
Multi-stage execution chain: MSI file -> PE -> Shellcode + DLL -> DLL side-loading via Cyglaunch legitimate software -> Shellcode + PE -> Kong RAT.
The campaign seems to be a continuation of a previous one documented in April 2026 that infected victims searching for Chinese developer tools such as FinalShell SSH client, Xshell, and Clash proxy.
Threat actor registered DeepSeek lookalike domains that delivered malicious ZIP archives containing MSI files.
Code-signed fake "DeepSeek Local Deployment Tool" adds false legitimacy, promoted via callmysoft[.]com/deepseek.
Attribution to a potential Chinese threat actor based on the PDB path that contains “52pojie”, a reference to a Chinese cybersecurity forum.
Users searching for DeepSeek software via search engines encounter malicious lookalike domains (e.g., deepseekcn[.]cyou) positioned on first-page results through SEO poisoning. These spoofed sites direct victims to download a 100MB+ archive named "DeepSeekV20.66-Setup.zip" containing a weaponized MSI installer that initiates the multi-stage infection chain.
The following diagram presents the multi-stage execution chain:
A Deeper Dive
The initial file called “DeepSeekV20.66-Setup.msi” drops a signed file called “DeepSeekV20.66.exe” (SHA256: f35c08fae77bcc13fdaa940fea21446fb78444fc2c6232abf4a2dd2d8890971a) and the malicious executable called “Setupapp.exe” (SHA256: 566449fe632fc7687d7a7f4b436ba01c1e38756bcab77567798452d000254c5c). PDB path “C:\Users\52pojie\Desktop\420\bin\Release\net10.0\win-x64\native\Update.pdb” is similar to one mentioned in this research.
Figure 1 - Files dropped by the MSI file
The purpose of the executable is to download a file masquerading as an MP4 file called “mao.mp4” from the malicious domain yyuupkk789.oss-cn-hongkong.aliyuncs[.]com. It uses the “Mozilla/5.0” user-agent and transfers the execution flow to the file using the VirtualAlloc and CreateThread APIs:
Figure 2 - Download of the next stage
mao.mp4 (shellcode + DLL) - 7e53218da42201e56a655c5ddb577ccd88cd9d92a291a02255841b2f1e910cec
A DLL is located at offset 0x12E9 in the file, as highlighted in the figure below. The shellcode allocates space and transfers the execution to the DLL.
Figure 3 - DLL is embedded in the .mp4 file
The malware enumerates all running processes looking for the “Telegram.exe” process. If found, it changes the application’s language to “classic-zh-cn”:
Figure 4 - Malware searches for the Telegram process
The process creates a staging directory in the “AppData\Local\Programs” folder. The name of the directory is derived from the serial number of the C drive, as shown in Figure 5.
Figure 5 - Create a staging directory
The directory name is exfiltrated to the same C2 server using the “/upload?log=PathInit:<Directory name>” URI via a function call to URLOpenBlockingStreamA. The following files are downloaded from the C2 server: “1.1x1”, “1.d11”, and “mao.bin”. The files are saved as “Defcyglaunch.exe.exe”, “cygwin1.dll” and “Uninstall.xml” in the staging directory. The executable is the legitimate “Cyglaunch” program (SHA256: 2025f9efd6e3166d7b69dd166a472f7fde21bc92dbef39c1f0e324ecd5088ea1) that is used for side-loading the malicious dropped DLL.
Figure 6 - Download 3 files in the new directory
CoCreateGuid is utilized to create a new GUID that is converted to printable characters using StringFromGUID2. The binary builds the “SimpleActivityScheduleTimer_<GUID>” string that is exfiltrated to the C2 server. It creates a scheduled task on the host that starts the side-loading activity via a function call to NdrClientCall3 and communicates the status to the C2 server (see Figure 7).
Figure 7 - Create a scheduled task to initiate the side-loading activity
cygwin1.dll (DLL) - 40650b0b1260d19d9979886c3ada8eb6cfa297c7a7e0f4c3d8612dc7ca43f129
The malicious process verifies if it’s running with admin privileges by calling the GetTokenInformation method (0x14 = TokenElevation):
Figure 8 - Verification of the process privileges
It establishes persistence by modifying the “Userinit” registry value from the “SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon” key. By default, the value points to the legitimate “userinit.exe” that runs during login.
Figure 9 - Create persistence on the infected host
The malware is looking for the downloaded “.xml” file in the current directory using the FindFirstFileA and FindNextFileA functions. It reads the file, allocates new memory and copies its content to the area using memcpy. Finally, the execution flow is transferred to the buffer.
Figure 10 - Load and execute the next stage
Uninstall.xml (shellcode + PE) - 72cae7dd93c6d0e72cd0af5510db25b7956c29e16eccd50da1ff6c7dacc39872
The executable can be extracted from the same offset 0x12E9.
The malicious process obtains the process token's integrity level value using GetTokenInformation (TokenIntegrityLevel parameter) and GetSidSubAuthority. The value is used to create a new mutex called “Local\ClientMutex_<DJB2 hash(Executable Path+SID)>”:
Figure 11 - Extract the process token's integrity level used to create a mutex
The malware ensures that the display remains on even if there is no user activity for a longer period of time using PowerSetRequest (PowerRequestDisplayRequired parameter):
Figure 12 - PowerSetRequest API call
The final payload that will be downloaded is a DLL. The process queries the “Software\Kong\Client\ClientVersion” registry key and tries to extract a value called “LastHash”, which indicates a previous download operation (Figure 13).
Figure 13 - Query a specific registry value for signs of download
It implements a custom protocol to communicate with the m.tysdt123[.]com C2 server on port 5947. The first packet contains the “MPK1” string, 0x1B (data size), and 0x154 that represents the command type.
Figure 14 - Custom packet is sent to the C2 server
The Kong RAT C2 server will transmit a 64-bit DLL in the response. The DLL is invoked based on the “run” export function and with the C2 server as the parameter, as highlighted below. Kong RAT was analyzed comprehensively in the following blog post. The RAT implements multiple commands such as downloading new files, executing commands, performing system reboots, and others.
Figure 15 - Downloaded DLL is invoked using the “run” export
Keylogger functionality
The malicious process extracts the clipboard data using the OpenClipboard and GetClipboardData APIs:
Figure 16 - Extract clipboard data
The clipboard data along with the keys pressed will be stored in a file called “<Current local date>.txt” created in the “C:\ProgramData\Kong\Keylogger” directory:
Figure 17 - Store the keys and clipboard data in a new .txt file
The malware verifies whether a key is up or down via a call to GetAsyncKeyState and retrieves the text of the specified window using GetWindowTextW.
Figure 18 - Extract information about the foreground window
It obtains the status of the virtual keys and translates the virtual-key code and keyboard state into characters, as displayed below.
Figure 19 - Convert virtual-key codes into characters to be written in the keylogger file
Indicators of Compromise
C2 domains
tyjssss777.oss-cn-hongkong.aliyuncs[.]com
qucisg666.oss-cn-hongkong.aliyuncs[.]com
yyuupkk789.oss-cn-hongkong.aliyuncs[.]com
steyyy888.oss-cn-hongkong.aliyuncs[.]com
m.tysdt123[.]com
zh.tysdt123[.]com
zh.szeom[.]com
cc.kmsccadn[.]com
Distribution Domains
deepseekcn[.]cyou
deepseekk[.]icu
deepsecek[.]com
deepseekem[.]com
Downloaded files
“AppData\Local\Programs\<Directory>\Defcyglaunch.exe.exe”
“AppData\Local\Programs\<Directory>\cygwin1.dll”
“AppData\Local\Programs\<Directory>\Uninstall.xml”
Mutex
Local\ClientMutex_<DJB2 hash(Executable Path+SID)>
Registry key
Software\Kong\Client\ClientVersion
Keylogger directory
C:\ProgramData\Kong\Keylogger
SHA256
MSI files
57ea0e992b999fb7be4f4690817dc687b862b97fbf41c6cfa5d9ce3374ace0ab
6c5d6d6ef3c825de9e52df37ccd8b611773f2bb0c47ed8328a7f5e68cdd5fcc6
9c0364a0759ec18a9b9ec1e3a78b07df5e2b378221cce8d69191354f7bde07e8
b8c268e22cd5bcb5f082b14354d3210aa6679f87c7dfc8255df00e57576474a9
33bacaa5064f5c24fe6b2f2964cf58f301ad1ea04ab02c732dfdfb2da56ea6a7
41c646d81780890785d0bd3f4f27312d308b4db9e9205e7b135b82a222f11981
5b675a1387aff6a151da77224fbfe732fc1beb2e8e9c91e471213db005d9e149
658401e3f09c4a068f73198ad27be285a6cfd03618c62d7a40c3f5da7d4248ed
e16b256d28ff34557c6ad975004ae2c392f66f65f1344780e69b6204dae97c0c
bb1d826e9a89f938cd617dfd5b1b41469c7c3971ff475a9105846d974c0d27c9
Other files
082a7b67fccdf73e859bff3a3c476d63862af92a848a88f2797cef482ace3da9
ec974e39a2e732101eddfc09bdcbc84c4eb69439d1342853f4034db2e85cb48f
6a1c563238f5489212cf1d10b28179e739c0ebc6af40e5d68e2a034f9c3b42b9
8b5c263809c6be09428706fe2f4ff868c98e946eca5072747171f278838a300a
1c3d0abdafd654633bd13a7427080439b2b7f255818c22b05b0cea6ce85d18a6
da0729c2593d54410457831fa118742708ab603cfed0e927acec38145b4f1cb1
33617f618530b00769afb2cf3b144e240ee241a59ed68b39c35926253e7f807b
566449fe632fc7687d7a7f4b436ba01c1e38756bcab77567798452d000254c5c
760942e8c107851a3222a000999de2b8abad9554fb3a72c3237e99eb35b7fb1f
fbc07658954f87579d615e72f76335f6fae5cec34a283535a37f72d6a4abce15
72cae7dd93c6d0e72cd0af5510db25b7956c29e16eccd50da1ff6c7dacc39872
40650b0b1260d19d9979886c3ada8eb6cfa297c7a7e0f4c3d8612dc7ca43f129
e160d0de903c3310fb374252322e0d642ea8d7156943e9b65445506c6f31525e
516efbb6b7df1667771ad64603daacdc5986416d8229588d1a16504c04053f36
83cb86e98b1663bb8735913c3129e84141c9988a29235be3cc689366a4faf0b7
a9b51f29d5408114b94c8e49d31b65ccd838e09b9a6bb887219737402a6ea5e6
94bbc3b9b884807b6eac46629d4cadbf4de627094ca2a2fef73b489f64bc18c1
51e5228295b012618a6ffaa9e18c791b709bdb446123d336a7d81dc05f6c8977
7f6796ea93b50b4195bfa4fcf634516d3b4107e637f4deb1d4b7e1c36acc721b
1e0e2b32d4daae9afeab5b54003e25b8fefdbe12f912f56859b27a89062c09f2
2984dead38ed5a6bc3c4cc22ba8331d751b30f72efbdd8617f772789d7428420
341bbb552abc9cd4a7a84a43be1ffdffae4032a0a2d8fbae0d3820b0ac8b4a4c
befffcf1ce2274fb7558bf68aeff9639975c6b5092fd458dfd4f1f7c77d2e6ac
cda5a99d6ebbea06d3fe7d5e8fba453b08f617ce866dc158eda968b184d446f0
7e53218da42201e56a655c5ddb577ccd88cd9d92a291a02255841b2f1e910cec
a355679022a2334aff05b286f8e54318fa9f96955947493c1775af39557183cd
c86dd314f2d17187d20beebcdaa1b736503d889b04edca6cdcb00454de3f8ef9
b18f12098b66bd0f7b7ac7da73d9a7f757ff8b3d2754a7c08015cacc2adbe5dd
4cb8a54db1b71a95ebf4953ec91a288ef1d004b6dd6fe6811dac2e636e4d3d67
a90402ef6fb8efd2856d0523c9f0eca64b87110bd9435cff10cbcf4836fc51eb
348f8074970a1eda5dedc7fd0b949fce61c5afeb520c101c7522daa2961d30dc
