SecuriTricks - seo poisoning

WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization

A malware campaign called WEBJACK is compromising Microsoft IIS servers to deploy BadIIS malware modules for SEO poisoning and fraud. The attackers hijack high-profile targets, including government and educational institutions, to redirect users to gambling websites. The campaign uses various tools…

seo poisoning

cobalt strike

Published: November 19, 2025

Downloadable IOCs: 34

Gootloader Returns: What Goodies Did They Bring?

Gootloader, a sophisticated JavaScript-based malware loader, has resurfaced with renewed activity. Used by threat actor Storm-0494, it grants access to Vanilla Tempest, which delivers various ransomware families. Recent infections have led to rapid domain controller compromises. The loader now uses…

wordpress exploitation

zeppelin

supper socks5 backdoor

Published: November 6, 2025

Downloadable IOCs: 136

Threat Actors Leverage SEO Poisoning and Malicious Ads to Distribute Backdoored Microsoft Teams Installers

A new campaign is distributing the Oyster (Broomstick) backdoor through trojanized Microsoft Teams installers. Threat actors are using SEO poisoning and malvertising to trick users into downloading fake installers from spoofed websites. The malicious installers deploy a persistent backdoor that ena…

Published: October 2, 2025

Downloadable IOCs: 15

Potentially Unwanted Applications (PUAs) weaponized for covert delivery

A malware distribution campaign leveraging digitally signed binaries, deceptive packaging, and browser hijackers has been uncovered. The campaign centers around two malicious applications, ImageLooker.exe and Calendaromatic.exe, delivered via self-extracting 7-Zip archives. These artifacts align wi…

trojanized-productivity-tools

code-signing-abuse

calendaromatic

browser-hijacker

Published: September 29, 2025

Linked vulnerabilities : CVE-2025-0411 (CVSS 7.0)

Downloadable IOCs: 6

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

A Chinese-speaking threat actor group, tracked as CL-UNK-1037, has been conducting a large-scale SEO poisoning campaign called Operation Rewrite. The attackers use a malicious IIS module named BadIIS to intercept and alter web traffic on compromised servers, manipulating search engine results to re…

Published: September 25, 2025

Downloadable IOCs: 71

Bengal cat lovers in Australia get psspsspss’d in Google-driven Gootloader campaign

A new Gootloader variant has been discovered using search engine optimization (SEO) poisoning to target Australian Bengal cat enthusiasts. The campaign uses Google search results for 'Are Bengal Cats legal in Australia?' to deliver malicious payloads. When users click on compromised links, a zip fi…

Published: November 6, 2024

Downloadable IOCs: 14

Threat Intelligence Alert: Phish 'n' Ships Fakes Online Shops to Steal Money and Credit Card Information

A sophisticated fraud scheme dubbed 'Phish 'n' Ships' has been uncovered, involving fake web shops that exploit digital payment providers to steal consumers' money and credit card information. The operation, traced back to 2019, has infected over 1,000 websites, created 121 fake web stores, and res…

phishing

seo poisoning

2024-10-31

chinese threat actors

credit card theft

fake web stores

payment processor abuse

search engine manipulation

e-commerce fraud

Published: October 31, 2024

Downloadable IOCs: 22

LUNAR SPIDER Enabling Ransomware Attacks on Financial Sector with Brute Ratel C4 and Latrodectus

LUNAR SPIDER, a Russian-speaking financially motivated threat group, has resumed operations following law enforcement disruptions. They've shifted from using IcedID to leveraging Latrodectus and Brute Ratel C4 malware, targeting financial services through SEO poisoning malvertising campaigns. The g…

infrastructure sharing

Published: October 31, 2024

Downloadable IOCs: 0

Rhysida Ransomware: Multi-Tiered Infrastructure and Early Detection Analysis

Insikt Group unveiled Rhysida's complex infrastructure, comprising typo-squatted domains for SEO poisoning, payload servers, CleanUpLoader C2 infrastructure, and higher-tier components including an admin panel and Zabbix monitoring server. This multi-tiered setup enables early victim identification…

Published: October 10, 2024

Downloadable IOCs: 106

SIEM agent being used in SilentCryptoMiner attacks

A global malware campaign targeting mainly Russian-speaking users has been distributing cryptocurrency mining malware through fake software download sites, Telegram channels, and YouTube videos. The multi-stage infection chain uses unusual techniques for persistence and evasion, including hiding ma…

Published: October 7, 2024

Downloadable IOCs: 8

Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant

A variant of WikiLoader loader for rent, also known as WailingCrab, is being delivered via SEO poisoning and spoofing of GlobalProtect VPN software. The campaign primarily affects U.S. higher education and transportation sectors. The infection chain involves multiple stages, including DLL sideloadi…

Published: September 2, 2024

Downloadable IOCs: 46

Behind the Great Wall Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 CC Framework

Trend Micro recently discovered a threat actor group dubbed Void Arachne targeting Chinese-speaking users with malicious Windows Installer (MSI) files containing legitimate software bundled with malicious Winos payloads. The campaign promotes compromised MSI files embedded with nudifiers, deepfake …

Published: June 19, 2024

Linked vulnerabilities : CVE-2024-21412

Downloadable IOCs: 46

Gootloader walkthrough

The analysis delves into the intricate workings of the Gootloader malware campaign. Through a meticulously crafted social engineering scheme involving SEO poisoning and fake forums, threat actors lure unsuspecting victims into downloading a malicious JavaScript file disguised as a legitimate resour…

Published: May 24, 2024

Downloadable IOCs: 12

Tag: seo poisoning

Attack reports

WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization

Gootloader Returns: What Goodies Did They Bring?

Threat Actors Leverage SEO Poisoning and Malicious Ads to Distribute Backdoored Microsoft Teams Installers

Potentially Unwanted Applications (PUAs) weaponized for covert delivery

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

August 2025 Infostealer Trend Report

GenAI Used to Impersonate Brazil's Government Websites

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

Bumblebee Malware SEO Poisoning Campaign Leads to Akira Ransomware Deployment

June 2025 Infostealer Trend Report

Stealthy PHP Malware Uses ZIP Archive to Redirect WordPress Visitors

May 2025 Infostealer Trend Report

Cybercriminals camouflaging threats as AI tool installers

Bengal cat lovers in Australia get psspsspss’d in Google-driven Gootloader campaign

Threat Intelligence Alert: Phish 'n' Ships Fakes Online Shops to Steal Money and Credit Card Information

LUNAR SPIDER Enabling Ransomware Attacks on Financial Sector with Brute Ratel C4 and Latrodectus

Rhysida Ransomware: Multi-Tiered Infrastructure and Early Detection Analysis

SIEM agent being used in SilentCryptoMiner attacks

Spoofed GlobalProtect Used to Deliver Unique WikiLoader Variant

Behind the Great Wall Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 CC Framework

Gootloader walkthrough