Group Uses SEO to Poison Google Search Results With Links to Banking Trojan

Discussion in 'BlackHat Lounge' started by Asif WILSON Khan, Nov 3, 2017.

  1. Asif WILSON Khan

    Asif WILSON Khan OG Blue Tick Exec VIP Jr. VIP

    Joined:
    Nov 10, 2012
    Messages:
    14,186
    Likes Received:
    39,300
    Gender:
    Male
    Occupation:
    Fun Lovin' Criminal
    Location:
    London
    Home Page:
    Black-hat SEO, for the win!
    This Zeus Panda group decided to rely on a network of hacked websites, on which they inserted carefully chosen keywords in new pages or hid the keywords inside existing pages.
    The group leveraged the favorable Google SERP (Search Engine Results Pages) ranking of the hacked sites to position these malicious pages at the top of Google search results for specific queries related to online banking and personal finances.

    For example, a person searching for "al rajhi bank working hours in ramadan" would see a malicious link ranked at the top of Google search results.

    Users clicking on these links would arrive on the hacked site, from where malicious JavaScript code would execute in the background and redirected the user through a series of sites until he reached one offering a Word document for download.

    Full story: https://www.bleepingcomputer.com/ne...-search-results-with-links-to-banking-trojan/
     
    • Thanks Thanks x 5
  2. Hay700

    Hay700 Jr. VIP Jr. VIP

    Joined:
    Mar 6, 2016
    Messages:
    344
    Likes Received:
    312
    Actually insane, thanks for the read.
     
  3. Asif WILSON Khan

    Asif WILSON Khan OG Blue Tick Exec VIP Jr. VIP

    Joined:
    Nov 10, 2012
    Messages:
    14,186
    Likes Received:
    39,300
    Gender:
    Male
    Occupation:
    Fun Lovin' Criminal
    Location:
    London
    Home Page:
    • Thanks Thanks x 2
  4. X

    X Jr. VIP Jr. VIP

    Joined:
    Jun 30, 2007
    Messages:
    1,068
    Likes Received:
    718
    Gender:
    Male
    Occupation:
    Digital Marketer & Automation Specialist
    Location:
    Texas
    This is fascinating. That's some evil work, but very impressive
     
  5. MisterF

    MisterF Moderator Staff Member Moderator Jr. VIP

    Joined:
    Nov 29, 2009
    Messages:
    11,959
    Likes Received:
    11,599
    Occupation:
    Conference Organiser, Business Advisor.,
    Location:
    JADIP
    Home Page:
    • Thanks Thanks x 2
  6. Erica_SEO

    Erica_SEO Jr. VIP Jr. VIP

    Joined:
    Jan 15, 2017
    Messages:
    284
    Likes Received:
    33
    Gender:
    Female
  7. SensualTyrannosaurus

    SensualTyrannosaurus Jr. VIP Jr. VIP

    Joined:
    Mar 19, 2015
    Messages:
    1,032
    Likes Received:
    1,803
    Occupation:
    I write things and the people love me for it.
    Location:
    Basement
  8. KHer0

    KHer0 Jr. VIP Jr. VIP

    Joined:
    Mar 22, 2011
    Messages:
    1,620
    Likes Received:
    1,501
    Gender:
    Male
    Wow, I feel sorry for these guys, they are brilliant at hacking and suck at optimization :)

    Too bad I am a Muslim an can't do blackhat stuff to earn my living :(

    All of this for stealing bank account and carding !!! You can buy cards for less than 5$/each easily in the underground web,,, Why all the hassle for such risk. He could send them to offers, cookie stuffing, e-mail submits and thousands of better ways.

    He could even sell those compromised websites as a backlinking service (Although I wonder about the quality of websites ranking for suck shitty keyword) and he would sell a backlin 5x the credit card easily...

    Well, I guess we are lucky they are not into internet marketing after all :)
     
  9. Asif WILSON Khan

    Asif WILSON Khan OG Blue Tick Exec VIP Jr. VIP

    Joined:
    Nov 10, 2012
    Messages:
    14,186
    Likes Received:
    39,300
    Gender:
    Male
    Occupation:
    Fun Lovin' Criminal
    Location:
    London
    Home Page:
    Has anybody researched the keywords they used? Might be an opportunity.
     
  10. KHer0

    KHer0 Jr. VIP Jr. VIP

    Joined:
    Mar 22, 2011
    Messages:
    1,620
    Likes Received:
    1,501
    Gender:
    Male
    The one you mentioned in the Op is Arabic keyword, and its worthless ... looks like the one who wrote the article doesn't know about IM.
     
    • Thanks Thanks x 1
  11. davids355

    davids355 Moderator Staff Member Moderator Jr. VIP

    Joined:
    Apr 25, 2011
    Messages:
    12,508
    Likes Received:
    10,553
    Location:
    Scotland
    Home Page:
    Pretty impressive use of Seo.
     
  12. Asif WILSON Khan

    Asif WILSON Khan OG Blue Tick Exec VIP Jr. VIP

    Joined:
    Nov 10, 2012
    Messages:
    14,186
    Likes Received:
    39,300
    Gender:
    Male
    Occupation:
    Fun Lovin' Criminal
    Location:
    London
    Home Page:
  13. KHer0

    KHer0 Jr. VIP Jr. VIP

    Joined:
    Mar 22, 2011
    Messages:
    1,620
    Likes Received:
    1,501
    Gender:
    Male

    There is this website called celebjihad ... It's about posting nude pictures of celebrities, and weird posts like if she don't join islam we will post more, this is jihad and we are muslims, neyahahahaha !!! And some weird comments with pretty weird pictures of people supposed to be Muslims (if you were living 1500 years ago!)

    Anyway, this website ranks for hundreds and hundreds of great keywords kicking out all big porn websites you can imagine of. I always wondered how would google let such website porning fake picture, racist, and breaking tons of rules (legal and ethics) and instead ranking it for very competitive keywords getting hundred of searches.

    But what was even weirder, big magazine websites like telegraph...etc are talking about it, giving it more exposure and free traffic.

    What I want to say, like media and everything else, there is always other agendas and when it comes to it, all big guys work together to deliver whatever message they want to.
     
  14. Asif WILSON Khan

    Asif WILSON Khan OG Blue Tick Exec VIP Jr. VIP

    Joined:
    Nov 10, 2012
    Messages:
    14,186
    Likes Received:
    39,300
    Gender:
    Male
    Occupation:
    Fun Lovin' Criminal
    Location:
    London
    Home Page:
    Hadn't heard of that site ... but will investigate ... it may take some time.

    https://en.wikipedia.org/wiki/Celeb_Jihad
    https://encrypted.google.com/search?q=celebjihad
     
  15. KHer0

    KHer0 Jr. VIP Jr. VIP

    Joined:
    Mar 22, 2011
    Messages:
    1,620
    Likes Received:
    1,501
    Gender:
    Male
    25 Million visits per month, and in top 1000 USA websites... It's HUGE :)

    And there are some famous celebrities who went to the court, but its immune. What is the funny is the website title says Muslim
    Extremists. Who the f*** calls himself extremists!!! Torrent website are bad and you go overseas hunting their owners but this website is legit and deserves google love :D
     
    • Thanks Thanks x 1