Google News SERP Leading To Malicious Sites

This blog post documents a malicious campaign that leverages Google News search results to socially engineer users into clicking links that, when referred from Google News, redirect to obfuscated JavaScript exploit pages which download multiple malicious JARs. The attackers use referrer checks, multi-stage redirects and heavy obfuscation to evade automated analysis and antivirus detection; the report includes source screenshots, Fiddler captures and VirusTotal results showing low detection.