Malware Attacks On Winter Solstice

This report documents an SEO poisoning campaign observed around December 21, 2009, where search queries (e.g., Winter Solstice 2009) returned malicious results that redirected users to sites offering fake security applications. The attacker-controlled sites used social engineering (popups, videos) to prompt downloads of executables (notably Flash_Plugin_Setup1261476530.exe and setup.exe); VirusTotal links in the report show poor antivirus detection, highlighting evasion and the potential for broad user compromise via search-engine manipulation.