HiddenGh0st, Winos, and kkRAT using SEO strategies and GitHub pages

Chinese-speaking users have become the primary target of a malicious search engine optimisation (SEO) poisoning campaign. This campaign employs fake software sites to distribute malware, posing significant risks to unsuspecting individuals. According to Fortinet FortiGuard Labs researcher Pei Han Liao, the attackers have manipulated search rankings by utilising SEO plugins. They have also registered lookalike domains that closely resemble legitimate software sites, making it difficult for users to discern the difference. This deceptive strategy aims to lure users into downloading harmful software under the guise of legitimate applications.

The attackers have crafted their content using convincing language and small character text to further mislead users. By presenting themselves as trustworthy sources, they exploit the vulnerabilities of those searching for software solutions. This tactic not only compromises the security of the users but also highlights the growing sophistication of cybercriminals in the digital landscape. As the threat of SEO poisoning continues to evolve, it is crucial for users to remain vigilant and cautious when downloading software from unfamiliar sites.