The Dark Side of SEO: Understanding SEO Poisoning

ReliaQuest documents a notable rise in SEO poisoning where threat actors manipulate search rankings to lure users to malicious pages that deliver malware (e.g., Gootloader, Solarmarker) and enable downstream compromises such as SystemBC RAT deployment, credential dumping, and data exfiltration; the report includes a May 2023 case study, an observed 10% month-over-month increase in detections, hunting techniques combining forward proxy and endpoint telemetry (including filename-to-query correlation using the Jaccard Index), and defensive recommendations (e.g., enable file extensions, change default script executors).