A Digital Trojan Horse: A New Campaign Is Using SEO to Deliver Malware

Researchers at FortiGuard Labs have uncovered a sophisticated SEO poisoning campaign aimed at Chinese-speaking users, manipulating search engine rankings and creating lookalike domains to lure victims into downloading malware disguised as legitimate software. According to FortiGuard Labs, the attackers set up multiple fraudulent websites designed to imitate trusted software providers, directing users searching for tools like DeepL to malicious download pages.

The attackers are described as using SEO plugins to inflate rankings and registered lookalike domains that closely mimic legitimate sites, with the malicious payload delivered through a script named nice.js that retrieves a secondary link from a JSON response and redirects victims to the final installer. The malware involved includes a DLL named EnumW.dll and components from a ZIP fragment, which together enable persistence and encrypted communications with command-and-control servers.

Once active, the campaign can exfiltrate data, capture keystrokes and clipboard content, and hijack cryptocurrency wallets, including targets such as Tether and Ethereum, with plugins like DifferentScreen[.]bin and HighSpeedScreen[.]bin linked to the Winos family. The analysis notes that the SEO-poisoning approach targeted Chinese-speaking users and relied on spoofed domains to masquerade as legitimate software providers.