Black Cat Behind SEO Poisoning Malware Campaign Targeting Popular Software Searches

Black Cat has been attributed to a search engine optimisation (SEO) poisoning campaign that uses fraudulent sites advertising popular software to trick users into downloading a backdoor capable of stealing sensitive data. According to CNCERT/CC and ThreatBook, the activity is designed to push bogus sites to the top of search results on engines such as Microsoft Bing, targeting users searching for programs like Google Chrome, Notepad++, QQ International and iTools.

After visiting these pages, users are redirected to convincing download pages that install a backdoor Trojan, with the malware then contacting a hard-coded remote server at sbido[.]com:2869 to exfiltrate information such as browser data and keystrokes. The group, active since at least 2022, has conducted multiple attacks for data theft and remote control, and in 2023 is said to have stolen at least $160,000 in cryptocurrency by impersonating AICoin.

In the latest operations, Notepad++ users are steered to a phishing site (cn-notepadplusplus[.]com) and other domains including cn-obsidian[.]com and cn-winscp[.]com, before the attack chain delivers a ZIP containing a malicious DLL. Between 7 and 20, 2025, CNCERT/CC and ThreatBook reported roughly 277,800 hosts compromised across China, peaking at 62,167 on a single day.