Black Hat SEO Poisoning Search Engine Results For AI
ID: a810474b-a418-5e29-a06a-3df7d3a9002e
STIX ID: report--a810474b-a418-5e29-a06a-3df7d3a9002e
Feed Name: Zscaler Security Research Blog
Threat Score
This technical analysis describes an active SEO-based campaign that lures users to AI-themed sites; embedded JavaScript hosted on CloudFront collects and XOR-encrypts browser data, sends it to gettrunkhomuto.info for validation, then redirects victims to payload pages delivering Vidar and Lumma stealers or Legion Loader via multi-stage encrypted archives and installers that employ NSIS, MSI custom actions, DLL sideloading, and process hollowing.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.