Seeing a fresh malvertising push today targeting developers with fake PuTTY installers signed with short‑lived certs. Ads on “putty download” queries are redirecting through rotating infra to an MSI that drops RedLine (first hit 09:20 UTC), elevating risk on dev endpoints with cached repo creds. From a hunting angle, watch for msiexec spawning unknown binaries and unexpected PuTTY paths — anyone confirming workable pre‑click blocks or reliable network IOCs?