Cybercriminals are hacking Google Looker Studio to position their malicious web sites excessive on the search engine’s outcomes pages, selling spam, pirated content material, and torrents. 

The marketing campaign makes use of a method referred to as search engine optimisation poisoning. This technique makes use of reliable web site copy and fills it with hyperlinks main to those malicious websites. Within the eyes of Google’s search engine algorithm, the hyperlinks give the spam websites sufficient credibility for the software to rank them excessive for particular key phrases.

This particular assault makes use of Google’s datastudio.google.com subdomain. 

Pretend blockbuster film downloads

BleepingComputer says it discovered a number of pages of Google search outcomes “flooded with datastudio.google.com hyperlinks”, after being tipped off by a involved reader. The hyperlinks don’t result in an precise Google Information Studio venture, however slightly to web sites internet hosting pirated content material, reminiscent of present blockbuster films (Black Adam, Black Panther: Wakanda Eternally, and related). 

Earlier than really touchdown on these pages, the victims will first be redirected a few instances, as nicely.

search engine optimisation poisoning is a identified technique, usually utilized by risk actors to enhance their probabilities of touchdown malware onto extra endpoints (opens in new tab). 

More often than not, search engine optimisation poisoning is used to push torrent websites excessive on Google’s outcomes pages for queries reminiscent of business software program, the newest films, or laptop video games. Shoppers trying to save a couple of {dollars} on software program and video games generally go on shady websites promising cracks and activators which might allow them to make use of the merchandise with out paying for the license.

More often than not, the activators and cracks don’t actually work as marketed, and all they do is distribute viruses, or malware. These malicious packages are able to wreaking every kind of havoc, from putting in cryptocurrency miners, to stealing delicate knowledge, to deploying ransomware and rendering the units fully ineffective. 

• Try the perfect web safety suites (opens in new tab) proper now

By way of: BleepingComputer (opens in new tab)