Tuesday, June 25, 2024

Hackers Poisoning the Google Search Results to Spreading Highly Sophisticated Banking Malware

Hackers poisoning Google search results to spreading stealthy Banking Trojan by targetting financial-related keyword searches and make this trojanized Malicious links in Top of the search results with highly trust rate and enabling them to target users with the Zeus Panda banking Trojan.

Nowadays cyber criminals are always one step ahead of traditional attack methods like Email spam and other common communication Medium to spreading the advance level threats.

In this case, poisoning the Google search algorithm to take advantage of this behavior by using Search Engine Optimization (SEO) to make their malicious links more prevalent in the search results that makes enabling them to target users with the Zeus Panda banking Trojan.

Poisoning the financial keywords search result, an attacker can achieve the maximum conversion rate of their infections which leads to gather some useful information about Victims various financial platforms and gain access by attacker and obtain credentials, banking, and credit card information, etc.

Also Read : Silence Trojan Targeting Financial Institutions Recording day to day activity on Bank Employees’ PCs

How Does Hackers Poisoning Google Search Results

Unlike traditional threat spreading methods like Email based malspam, attacker using specific sets of search keywords which will query by targets using search engines such as Google and Bing.

It will be achieved through a compromised web servers and using those servers attackers ensure that, their malicious results would be ranked highly within search engines which will force the viewer to click the top search results.

For an Example, Cisco Talos have analyzed a Specific keyword “al rajhi bank working hours in ramada” that gives a search result with legitimate reviews and top ratings which could achieve by leveraging compromised business websites by poisoning Google Search Results.

Attackers always targetted by mostly used Financial keywords which belong to Bank and Financial sectors.

Especially, poisoning Google Search Results specific to financial institutions in India as well as the Middle East is the region which belongs to most used financial keyword.

    “nordea sweden bank account number”
    “al rajhi bank working hours during ramadan”
    “how many digits in karur vysya bank account number”
    “free online books for bank clerk exam”
    “how to cancel a cheque commonwealth bank”
    “salary slip format in excel with formula free download”
    “bank of baroda account balance check”
    “bank guarantee format mt760”
    “free online books for bank clerk exam”
    “sbi bank recurring deposit form”
    “axis bank mobile banking download link”

So while victims browsing compromised Webservers serach results  they would initiate a multi-stage malware infection process that was redirected to  fake AV scams that display images informing victims that their systems are infected with Zeus and instructing them to contact the listed telephone number.

When the malicious web pages are accessed by victims, the compromised sites use Javascript to redirect clients to Javascript hosted on an intermediary site and  this results in the client retrieving and executing Javascript and you can read complete technical analysis for the Mailicious JS File that has been downloaded by Vicitm.


Latest articles

Threat Actor Claiming a 0-day in Linux LPE Via GRUB bootloader

A new threat actor has emerged, claiming a zero-day vulnerability in the Linux GRUB...

LockBit Ransomware Group Claims Hack of US Federal Reserve

The notorious LockBit ransomware group has claimed responsibility for hacking the U.S. Federal Reserve,...

Microsoft Power BI Vulnerability Let Attackers Access Organizations Sensitive Data

A vulnerability in Microsoft Power BI allows unauthorized users to access sensitive data underlying...

Consulting Companies to Pay $11 Million Failing Cybersecurity Requirements

Two consulting companies, Guidehouse Inc. and Nan McKay and Associates, have agreed to pay...

New RAT Malware SneakyChef & SugarGhost Attack Windows Systems

Talos Intelligence has uncovered a sophisticated cyber campaign attributed to the threat actor SneakyChef....

Chinese Winnti Group Intensifies Financially Motivated Attacks

Hackers are increasingly executing financially motivated attacks and all due to the lucrative potential...

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from Promokit.eu for...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles