Black Hat SEO Leveraged to Distribute Malware

This report documents a search-engine poisoning campaign that lures users to fraudulent file-hosting pages and delivers an obfuscated multi-stage malware installer. The attack chain includes referral checks to evade researchers, nested password-protected ZIP archives (password hidden in an image), execution of a setup that installs legitimate GPG alongside a malicious libgcrypt-20.dll used for DLL sideloading, process hollowing of explorer.exe, PowerShell-based retrieval and multilayer deobfuscation of payloads, and the deployment of a malicious browser extension for persistence and further malicious activity.