SEO Poisoning and Malvertising: Weaponising the Search Result

SEO poisoning (search poisoning) and malvertising (malicious advertising) weaponise what victims find in search. SEO poisoning engineers attacker-controlled or compromised sites to rank highly for software, document or how-to queries; malvertising buys paid search and display ads — notably Google Ads — impersonating well-known brands. Both funnel the victim to a page serving a trojanised installer or malicious script, with cloaking and conditional redirects (often via traffic-distribution systems) so the payload fires only for targeted victims. Because the victim downloads and runs the “installer” themselves, the chain bypasses many email and network defences.

How It Works

SEO poisoning uses keyword stuffing, hidden text and hijacked CMS/WordPress sites to climb the organic rankings; malvertising rents the top of the page with brand-impersonating ads. Cloaking keeps the ad and landing page clean for reviewers while serving malware to targets. The two official Resource-Development techniques are T1608.006 (SEO poisoning) and T1583.008 (malvertising); the downstream compromise maps to T1189 drive-by compromise and T1204.002 user execution of a malicious file.

Notable Campaigns

• Gootloader: a JavaScript loader distributed by SEO poisoning of compromised sites offering business documents; Mandiant attributes GOOTLOADER to UNC2565 (active since around 2020).
• BATLOADER: delivered via Google Ads impersonating software such as Teams and Zoom; Microsoft tracks the activity as DEV-0569, acting as an initial-access broker linked to Royal ransomware and to stealer/loader delivery.
• SocGholish / FAKEUPDATES: a fake-browser-update lure commonly tracked to the TA569 cluster (often categorised as drive-by rather than strict SEO poisoning).

MITRE ATT&CK Mapping

Detection & Mitigation

• Tell users to reach software via official vendor domains, not search ads; deploy ad-blocking and enforce SafeSearch at the enterprise.
• Apply DNS and web filtering; block or scrutinise newly registered and typosquatted look-alike domains, and monitor for brand abuse.
• Build EDR detections for installers (MSI/EXE) and script interpreters (PowerShell/JScript/wscript) spawned from browser-download or archive-extraction paths; restrict script-host execution.
• Apply application control to stop unsanctioned installers, and monitor threat intel for malicious ads impersonating your brand and for known loader infection patterns.