SEO Poisoning and Malvertising Delivery
Not every initial access technique requires sending an email. SEO poisoning and malvertising deliver payloads to victims who are actively searching for something — cracked software, free tools, enterprise software trials, or specific technical downloads. The victim doesn't receive anything suspicious; they find what appears to be a legitimate download link through normal browsing. This chapter covers how SEO poisoning works at the infrastructure level, how malvertising abuses ad networks, how to build convincing lure sites, what detection looks like from the defender's side, and how these techniques fit into broader initial access campaigns.
SEO Poisoning — How It Works
Goal: appear at the top of search results for a targeted query.
─────────────────────────────────────────────────────────────────────────
Target queries (common examples attackers have poisoned):
"free download [legitimate software]"
"cracked [enterprise software] license"
"[software name] offline installer"
"[technical tool] download windows"
"convert pdf to word free"
"[software] serial key generator"
How attacker pages rank high:
─────────────────────────────────────────────────────────────────────────
1. Keyword stuffing: page contains the target query hundreds of times,
in hidden text, in metadata, in comment blocks
2. Backlink networks: attacker controls many sites that link to the
poisoned page, artificially inflating its PageRank
3. Domain age manipulation: buy aged domains with existing authority
4. Content cloaking: serve benign content to Google's crawler (which visits
from known Google IPs), but serve the malicious page to real visitors
→ Google indexes a clean page; humans see the malicious one
5. Redirect chains: the listed URL redirects to the real malicious host
after checking visitor fingerprints (browser, IP geolocation)
Attack flow:
─────────────────────────────────────────────────────────────────────────
Victim searches for "[target query]"
→ Attacker page appears in top results (SEO poisoning worked)
Victim clicks result
→ Server fingerprints the visitor (IP, user agent, browser)
→ If real victim (not scanner/bot): serve malicious download page
→ If crawler/scanner: serve benign content
Victim downloads "free_software_v2.1.exe"
→ Looks like the software they wanted
→ Actual content: trojanized version with payload DLL or bundled installer
Victim runs the installer
→ Software installs (the trojan includes real software for legitimacy)
→ Payload also installs: drops DLL, creates persistence, calls home to C2Malvertising — Abusing Ad Networks
How malvertising works via Google Search ads:
─────────────────────────────────────────────────────────────────────────
1. Attacker creates a Google Ads account (may use stolen identity/payment)
2. Purchases ads targeting specific search queries:
- "download [legitimate popular software]"
- "[enterprise software] trial"
- "[bank name] login"
3. Creates a landing page that looks exactly like the official website
(typosquat domain or look-alike: "adobe-acrobat-download[.]com")
4. The ad appears above organic results with SPONSORED label
5. Many users click ads without distinguishing them from organic results
6. Landing page shows a convincing download button
7. Clicking downloads a trojanized installer
Why it bypasses email security completely:
─────────────────────────────────────────────────────────────────────────
• No email sent — victim finds the page themselves
• No attachment to scan
• The URL passes through the browser, not an email gateway
• The download happens over HTTPS from a CDN-hosted URL
• Nothing in the download chain looks suspicious from a security tool perspective
The "SPONSORED" label problem:
─────────────────────────────────────────────────────────────────────────
Google Ads policy technically prohibits malicious ads.
But: ads are reviewed by automated systems that often can't detect:
• Delayed payloads (download is clean; installs become malicious later)
• Cloaking (serve clean installer to ad reviewer, malicious to victims)
• Short campaign windows (malicious ads run for hours before removal)
Real example: In 2023, malvertising for AnyDesk, Notepad++, Slack, Zoom,
7-Zip, and other legitimate tools was used to deliver Vidar, IcedID, and
various information stealers. Victims thought they were downloading
legitimate software from official-looking sites.Typosquatting and Infrastructure Setup
Domain selection for SEO poisoning / malvertising campaigns:
Typosquatting strategies:
adobe.com → adobe-download.com, adoble.com, adob3.com
notepad-plus-plus.org → notepadplusplus-download.com, notepadplusdownload.com
7-zip.org → 7zip-download.com, sevenzip.org, 7-ziip.com
Techniques:
- Omit hyphen: "notepad-plus-plus" → "notepadplusplus"
- Add "download": "7-zip" → "7-zip-download"
- TLD variation: .org → .net, .co, .site, .app
- Character substitution: l→1, o→0, i→l
- Homograph attack: using Unicode chars that look like ASCII (cirillic а ≠ latin a)
Landing page requirements:
• SSL certificate (Let's Encrypt — free, takes 2 minutes)
• Legitimate-looking design (copy the real site's CSS/HTML exactly)
• Download button that serves the trojanized installer
• "Why is my antivirus flagging this?" FAQ (social engineering)
• Metadata/SEO tags matching the target query
Visitor fingerprinting (cloaking):
Server-side check before serving malicious content:
if (is_googlebot(user_agent) or is_known_scanner(ip)):
serve legitimate_clean_installer()
elif (geolocation(ip) not in target_countries):
serve 404 or redirect to real site
else:
serve malicious_installer()
IP ranges to exclude (known security scanners):
- Google/Bing/Yandex crawler ranges
- VirusTotal submission ranges
- Known AV vendor ranges
- Tor exit nodesBuilding a Trojanized Installer
The trojanized installer must install the real software (victim expects it to work)
while also installing your payload. Common approaches:
1. NSIS (Nullsoft Scriptable Install System) — most common:
- Bundle real software installer + payload DLL
- NSIS script runs both: installs real software, silently drops + executes payload
- NSIS is signed by many legitimate software vendors → less suspicious
2. InnoSetup wrapper:
- Create InnoSetup project that runs the real installer + payload
- Sign the final installer with a code signing cert if possible
3. MSI bundling:
- Create MSI package that installs real software + runs a custom action
- Custom action = your payload dropper (runs as SYSTEM during install)
NSIS example (abbreviated):
!include MUI2.nsh
OutFile "notepad_plusplus_installer.exe"
InstallDir "$LOCALAPPDATA\notepad++"
Section "Main"
SetOutPath "$TEMP"
File "real_npp_installer.exe" ; the real Notepad++ installer
File "payload.dll" ; your malicious DLL
File "loader.exe" ; your loader that side-loads payload.dll
; Install the real software (victim sees this progress bar)
ExecWait '"$TEMP\real_npp_installer.exe" /S'
; Silently drop and execute payload
CopyFiles "$TEMP\payload.dll" "$LOCALAPPDATA\Microsoft\Update\payload.dll"
CopyFiles "$TEMP\loader.exe" "$LOCALAPPDATA\Microsoft\Update\update.exe"
Exec '"$LOCALAPPDATA\Microsoft\Update\update.exe"'
SectionEndDetection Footprint for Defenders
Detection source │ Signal │ Notes ──────────────────────────┼────────────────────────────────────────┼──────────────────────── DNS reputation │ Query to freshly registered domain │ Domain age < 30 days URL reputation │ HTTP GET to known malvertising domain │ TI feeds, Google SafeBrowse Download scanning │ EXE/MSI download from unknown domain │ Defender SmartScreen Process behavioral │ Installer spawns unexpected child procs │ EDR behavioral File analysis │ Downloaded file contains 2+ PE binaries │ AV detects bundler Sysmon 11 │ Multiple files written to %TEMP% by inst│ Payload + real installer Sysmon 1 │ Installer spawns "update.exe" silently │ Name + path suspicious ──────────────────────────┴────────────────────────────────────────┴──────────────────────── The detection window: SEO poisoning and malvertising campaigns often run for days to weeks before being taken down. The first victims generate threat intelligence → URL block- lists are updated → campaign effectiveness drops. Quick rotation of domains and hosting is essential for operational longevity.
Questions & Answers
How do attackers get SEO poisoning pages to rank above legitimate results?
The core techniques: (1) Black-hat link building — the attacker operates or rents a network of websites that all link to the poisoned page, artificially inflating its PageRank. (2) Compromised legitimate sites — injecting the poisoned page content into a hacked high-authority domain is far more effective than building from scratch. (3) Content cloaking — serving clean, keyword-optimized content to Google's crawler while serving malicious content to humans. (4) Targeting long-tail queries — instead of competing on "download Notepad++," target "notepad++ offline installer no internet" which has less competition and can rank faster. The effectiveness depends heavily on query specificity and how much Google's algorithm weights recency vs authority for download-type queries.
What makes victims not notice the fake download site?
Modern web design tools make pixel-perfect clones trivial: download the real site's HTML/CSS with wget, change the download URL to point to your server, host it on a typosquatted domain with a valid TLS certificate. The address bar shows "adobe-download.com" with a green lock icon — to a user who didn't memorize "adobe.com" exactly, this looks legitimate. Additionally: (1) the installer works — it installs the real software, so the victim's expected experience is fulfilled; (2) some antivirus tools may not flag the installer immediately, especially if the payload is staged (downloads at runtime); (3) the URL may appear in a Google ad with the text "adobe.com" as the display URL while the actual destination is the typosquat domain — Google policies are supposed to prevent this but enforcement is imperfect.
How do defenders detect SEO poisoning before employees fall for it?
Proactive defenses: (1) DNS/URL filtering that blocks newly registered domains and known malvertising infrastructure; (2) browser extensions or security controls that highlight when a visited domain doesn't match the expected legitimate domain; (3) download scanning at the proxy level that submits downloaded EXE/MSI files to sandboxes before delivery; (4) user education specifically about the "SPONSORED" label in search results and typosquatting; (5) subscribing to threat intelligence feeds that track ongoing malvertising campaigns — many campaigns are public within hours of detection. Reactive: the primary artifact is an EXE/MSI written to disk and executed — EDR behavioral detection and AV scanning at the endpoint are the last line.