Tuesday, February 27, 2024

Hackers Poisoning the Google Search Results to Spreading Highly Sophisticated Banking Malware

Hackers poisoning Google search results to spreading stealthy Banking Trojan by targetting financial-related keyword searches and make this trojanized Malicious links in Top of the search results with highly trust rate and enabling them to target users with the Zeus Panda banking Trojan.

Nowadays cyber criminals are always one step ahead of traditional attack methods like Email spam and other common communication Medium to spreading the advance level threats.

In this case, poisoning the Google search algorithm to take advantage of this behavior by using Search Engine Optimization (SEO) to make their malicious links more prevalent in the search results that makes enabling them to target users with the Zeus Panda banking Trojan.

Poisoning the financial keywords search result, an attacker can achieve the maximum conversion rate of their infections which leads to gather some useful information about Victims various financial platforms and gain access by attacker and obtain credentials, banking, and credit card information, etc.

Also Read : Silence Trojan Targeting Financial Institutions Recording day to day activity on Bank Employees’ PCs

How Does Hackers Poisoning Google Search Results

Unlike traditional threat spreading methods like Email based malspam, attacker using specific sets of search keywords which will query by targets using search engines such as Google and Bing.

It will be achieved through a compromised web servers and using those servers attackers ensure that, their malicious results would be ranked highly within search engines which will force the viewer to click the top search results.

For an Example, Cisco Talos have analyzed a Specific keyword “al rajhi bank working hours in ramada” that gives a search result with legitimate reviews and top ratings which could achieve by leveraging compromised business websites by poisoning Google Search Results.

Attackers always targetted by mostly used Financial keywords which belong to Bank and Financial sectors.

Especially, poisoning Google Search Results specific to financial institutions in India as well as the Middle East is the region which belongs to most used financial keyword.

    “nordea sweden bank account number”
    “al rajhi bank working hours during ramadan”
    “how many digits in karur vysya bank account number”
    “free online books for bank clerk exam”
    “how to cancel a cheque commonwealth bank”
    “salary slip format in excel with formula free download”
    “bank of baroda account balance check”
    “bank guarantee format mt760”
    “free online books for bank clerk exam”
    “sbi bank recurring deposit form”
    “axis bank mobile banking download link”

So while victims browsing compromised Webservers serach results  they would initiate a multi-stage malware infection process that was redirected to  fake AV scams that display images informing victims that their systems are infected with Zeus and instructing them to contact the listed telephone number.

When the malicious web pages are accessed by victims, the compromised sites use Javascript to redirect clients to Javascript hosted on an intermediary site and  this results in the client retrieving and executing Javascript and you can read complete technical analysis for the Mailicious JS File that has been downloaded by Vicitm.


Latest articles

Abyss Locker Ransomware Attacks Microsoft Windows and Linux Users

FortiGuard Labs has released a report detailing the emergence and impact of the Abyss...

14-Year-Old CMS Editor Flaw Exploited to Hack Govt & Edu Sites

Hackers have exploited a vulnerability in a 14-year-old Content Management System (CMS) editor, FCKeditor,...

Zyxel Firewall Flaw Let Attackers Execute Remote Code

Four new vulnerabilities have been discovered in some of the Zyxel Firewall and access...

Hackers Abuse Telegram API To Exfiltrate User Information

Attackers have been using keywords like "remittance" and "receipts" to spread phishing scripts using...

ThreatHunter.ai Stops Hundreds of Attacks in 48 Hours: Fighting Ransomware and Nation-State Cyber Threats

The current large surge in cyber threats has left many organizations grappling for security...

WordPress Plugin Flaw Exposes 200,000+ Websites for Hacking

A critical security flaw has been identified in the Ultimate Member plugin for WordPress,...

Hackers Actively Hijacking ConnectWise ScreenConnect server

ConnectWise, a prominent software company, issued an urgent security bulletin on February 19, 2024,...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles