SEO poisoning, also called search engine poisoning, is a cyberattack where criminals push malicious pages into top search results so people click them. Victims land on fake downloads, phishing pages or malware. It works because people trust the first results they see. This guide covers how it works, real campaigns, warning signs and defenses.
It also matters if you own a brand. Fake pages that use your name in search results can steal your customers’ logins and damage trust, even though your own systems were never breached.
What Is SEO Poisoning?
SEO poisoning abuses the way search engines rank pages. Attackers pick search terms people really use, such as a software name or a business document. They then make a harmful page rank for those terms. Some call it Google poisoning, because Google is the engine most people use.
MITRE ATT&CK tracks it as technique T1608.006, where adversaries “poison mechanisms that influence search engine optimization (SEO)”. MITRE also notes that the technique “cannot be easily mitigated with preventive controls”, because it happens outside your network. That is why detection and response matter as much as prevention.
How Does an SEO Poisoning Attack Work?
Most attacks follow the same five steps. The attacker does not need to break into the victim at the start. The victim walks in through a search result.
- Pick the baitChoose a search term people use, such as a software name or a document template
- Get a page that can rankHijack a trusted site or register a look-alike domain
- Rank for the termUse keyword stuffing, spam links or the hijacked site’s reputationTechnique T1608.006 (MITRE ATT&CK, opens in a new tab)
- Show the lureRedirect visitors to a fake download, fake sign-in page or fake forum
- Deliver the payloadThe visitor installs malware or types credentials into the attacker’s page
Attackers often hide the trick from the site owner and from search engine crawlers. Google calls this cloaking: showing different content to users and to search engines. Hackers use it so the owner of a hacked site does not notice the change.
Which Techniques Do Attackers Use?
Attackers mix several methods. The table shows the common ones, what the attacker does and what the victim sees.
| Technique | What the attacker does | What the victim sees |
|---|---|---|
| Keyword stuffing and spam networks | Fills pages with popular terms and links them together to look important | A thin page that ranks but gives no real answer |
| Compromised sites | Injects code or new pages into a legitimate site that already ranks well | A trusted domain that sends them to a fake page |
| Cloaking | Shows search engines one page and visitors another | A normal result that opens something different |
| Look-alike domains | Registers a domain close to a real brand or software vendor | A fake site that looks like the real download or login page |
| Fake software and document lures | Targets searches for tools, installers and business templates | A ZIP file or installer that carries malware |
| Malvertising | Buys search ads that point to a fake page | A sponsored result above the real one |
Google describes the hacked-site case as “content placed on a site without permission, due to vulnerabilities in a site’s security”. It lists code injection, page injection and content injection. Our glossary entries on typosquatting and malvertising cover the two techniques that overlap most.
What Do Real SEO Poisoning Campaigns Look Like?
Gootloader is a long-running case. Microsoft says its operators compromise WordPress sites that rank highly in search engines and poison results for business document templates. Visitors land on a fake forum page with a download link. The file is a ZIP archive that holds a JavaScript file.
Sophos describes the same method: hijacked Google results send people to compromised, legitimate WordPress sites. Sophos also found that the changes are so well hidden that site owners often cannot spot them. Microsoft adds that the main target is enterprise networks, and that the most common final payload is a Cobalt Strike Beacon. In some cases attackers reached a domain controller in less than one hour.
Storm-2561 is a recent example. In a post dated 12 March 2026, Microsoft says this actor has been active since May 2025 and spreads malware through SEO poisoning. People who searched for enterprise VPN software, such as “Pulse VPN download”, were sent to spoofed vendor sites. Those sites served a ZIP file with a signed trojan that looked like a VPN client.
The fake client captured the VPN sign-in details people typed in. It then showed an installation error and pointed them to the real client, so users were likely to blame a technical glitch, not malware. MITRE ATT&CK also lists groups that have used SEO poisoning, including Mustard Tempest and NIMBUS MANTICORE.
Who Gets Targeted and What Does It Cost?
Both campaigns above aim at people at work: staff who search for a document template or a VPN client. One stolen login or one infected laptop can open the door to the whole network. That is why security teams treat a search click as a possible entry point.
Brand owners face a second problem. When criminals rank a fake page for your brand name, your customers see it next to your real site. The cost shows up as lost trust, more support calls and clean-up work. If your own site is hacked to host the lure, your search visibility can drop too.
How Can You Spot SEO Poisoning?
Warning signs differ for users and for site owners.
- A result for a software download that is not on the vendor’s own domain.
- A download that is a ZIP file or script when you expected an installer from the vendor.
- A page that redirects more than once before it loads.
- New pages on your own site that you did not publish, often with spam or odd keywords.
- Warnings in the Security issues report in Google Search Console, which “lists indications that your site was hacked”.
- Fake sites that use your brand name when you search for it yourself.
Search your own brand name and your product names on a schedule. Check the first two pages of results, including ads. If a result looks wrong, review the domain before anything else.
How Do You Defend Against SEO Poisoning?
For Employees and IT Teams
Microsoft’s guidance on these campaigns is practical. Get document templates only from approved internal sources, not from forums found through search. Enforce multifactor authentication on all accounts, and prefer phishing-resistant methods such as passkeys for privileged accounts.
For Gootloader, Microsoft also suggests blocking Windows Script Host from running .js and .jse files, and blocking scripts from user-writable folders. Give staff an easy way to report an unexpected ZIP download. For Storm-2561, Microsoft adds: turn on web protection and cloud-delivered protection in your endpoint tools.
For Brand Owners
You cannot stop attackers from using your name, but you can find them fast. Watch for new look-alike domains, fake login pages and fake download sites. Our phishing and domain abuse monitoring module covers this, and the brand takedown module handles removal. Keep your own site patched and review who can publish to it, since a hacked site is a ready-made lure. Our guide to takedown tactics shows how removal works.
- Search your brand and product namesReview the first two pages, including ads, every week.
- Watch for look-alike domainsCheck new domains that copy your name or products.
- Lock down your own sitePatch, limit publishing rights and watch for pages you did not create.
- Set a template source ruleStaff take document templates only from approved internal sources.
- Enforce MFAUse phishing-resistant methods for privileged accounts.
Is “SEO Attack” the Same as SEO Poisoning?
Not always. “SEO attack” and “SEO hacking” are used for different things. SEO poisoning is a security attack that aims to infect or defraud people who search. Negative SEO is a different problem: someone harms a competitor’s rankings with spam links or fake content. Black hat SEO is the wider set of rule-breaking ranking tricks, which our black hat SEO overview explains. SEO poisoning uses black hat methods, but with a malicious goal.