What Is SEO Poisoning?

You know how companies use SEO to get their products to show up first when you search for something? Well, threat actors have flipped that script. SEO poisoning, or search engine poisoning, is all about hijacking those same techniques for chaos. They're not selling you a new pair of sneakers; they're trying to deliver a payload of malware straight to your device.

Here’s the breakdown of how they pull it off:

• Keyword stuffing: Attackers will pack their malicious sites with popular or trending keywords. They'll target hot topics like major software updates, blockbuster movie downloads, or big news events. The idea is to piggyback on high search traffic to get their dangerous links in front of as many eyeballs as possible.

• Link farming and backlinks: Search engines see links from other sites as a vote of confidence. So, attackers create networks of fake websites (link farms) or compromise legitimate but low-security sites. They then use these sites to create thousands of backlinks pointing to their malicious page, artificially boosting its authority and search ranking.

• Cloaking: This is where it gets extra sneaky. Attackers will show one version of their site to search engine crawlers—something harmless and keyword-rich—and a completely different, malicious version to actual users. The search engine thinks the site is legit, while you get served a phishing page or a drive-by download.

The end game is always the same: get the user to click. Once you land on their page, you could be facing a drive-by download that installs malware without you doing anything, a fake login page designed to harvest your credentials, or a site that locks your browser and demands a ransom.