Hackers lure users, install malware via Google Search

Cyber security researchers have found a new malware that is tricking Google into treating hacked websites as trustworthy sources and presenting innocent users with apparently perfect matches to their search queries on the platformThe hackers are using the malware dubbed as Gootloader to lure wellmeaning users into installing the malware on their devices putting them at ransomeware risk according to the report by Naked Security which is global cyber security firm Sophoss threat intelligence unitThe Gootkit malware family has been around more than half a decade a mature Trojan with functionality centered around banking credential theftHowever in recent years almost as much effort has gone into improvement of its delivery method as has gone into the malware itselfThis is how the modus operandi worksThe hackers break into hundreds of web servers and implant artificially generated content containing phrases that search engines are likely to associate with expertise in a specific field like real estate employment law importexport regulations company partnerships and moreFrom time to time the crooks get lucky and one or their hacked sites turns up as a top hit on Google thanks to a specific search term entered by an innocent user the report saidTheres a good chance that the user will click the Google link that shows up because the search hit looks like a natural result given that its not a paid ad or a sponsored linkIf the user clicks through to the hacked server the crooks recognise that the click came via a Google search by using the Referer in the web requestThe server deliberately sends out a fraudulent web page that looks like a message board on which someone else recently asked the same thingTo make the page look even more convincing theres a further reply apparently from the original questioner thanking the administrator for their prompt and helpful answer the report mentionedGoogle was yet to react to the Sophos reportSophosLabs encountered Gootloaders fake message board pages in a variety of different languages including English German French and Korean with different campaigns targeted at different regionsThis search poisoning trick works because the website you visit seems to fit your search perfectly which feels like too much of a coincidence for a crook to have anticipated it in advance said the researchersThis story has been sourced from a third party syndicated feed agencies Midday accepts no responsibility or liability for its dependability trustworthiness reliability and data of the text Midday managementmiddaycom reserves the sole right to alter delete or remove without notice the content in its absolute discretion for any reason whatsoever