Black Cat cybercrime gang conducts SEO poisoning campaigns using fraudulent websites that rank high in search results on Microsoft Bing. Users searching for popular software are redirected to phishing sites, then to fake GitHub pages to download ZIP archives containing malicious installers. The installer creates a desktop shortcut that side-loads a malicious DLL, which launches a backdoor that connects to sbido.com:2869. The malware steals browser data, logs keystrokes, extracts clipboard contents, and exfiltrates sensitive information. Between January 7-20, 2025, the campaign compromised approximately 277,800 hosts in China.