SEO poisoning is a technique in which attackers manipulate search engine rankings so that malicious websites appear at the top of results for popular or targeted search queries.
How SEO poisoning works
Instead of sending phishing emails, the attackers wait for victims to come to them. They use black-hat search engine optimisation to push their pages up the rankings:
- compromising legitimate websites, often outdated WordPress installations, and adding hidden pages stuffed with keywords;
- creating large link networks and spam pages that point to the malicious site;
- targeting queries for free software, cracked tools, templates and documents, or breaking news;
- cloaking – showing search engine crawlers harmless content while real visitors get the malicious version.
MITRE ATT&CK lists the technique as T1608.006. It is often combined with malvertising, where criminals buy search ads instead of earning organic rankings.
Why SEO poisoning matters
Users trust search results, so poisoned pages achieve high click rates without any email filter in the way. The Gootloader campaigns are a well-known example: they placed fake forum pages on hacked websites answering searches such as legal agreement templates, then delivered a ZIP archive with a JavaScript file that installed a malware loader, leading to ransomware and other intrusions. Similar operations distribute infostealers through fake downloads of popular software, and target system administrators searching for tools such as remote management utilities.
How to protect against SEO poisoning
- Download software only from official vendor sites or managed company repositories.
- Be suspicious of search results that lead to forum posts with download links or unexpected archives.
- Block execution of scripts such as .js and .vbs files from downloads and use web filtering.
- Keep your own CMS and plugins updated so that your site is not used as a host for poisoned pages.
