Description

The research revealed how threat actors are exploiting SEO poisoning techniques to redirect unsuspecting users to fraudulent e-commerce websites, using various families of SEO-related malware to achieve their objectives. Three distinct threat actor groups were identified, each utilizing a different malware family, with one group leveraging multiple malware families to amplify their attacks. One particular malware family was notable for its Command and Control (C&C) servers, which were associated with a limited set of fake e-commerce sites, setting it apart from other families that managed independent lists of compromised sites. The rise of fraudulent e-commerce sites, particularly in Japan, has become a growing concern. In 2023, there was a significant increase in the number of fake shopping sites, resulting in considerable financial losses and the exposure of personal data. These sites are typically deployed by attackers to deceive consumers, often masquerading as legitimate platforms while engaging in fraudulent activities. The attackers inject SEO malware into compromised websites to manipulate search engine rankings, redirecting unsuspecting users to malicious e-commerce sites designed to scam them. SEO malware operates by first compromising legitimate websites and injecting malicious code that interferes with search engine results. The attackers then craft specially tailored sitemaps, which are submitted to search engines to promote fraudulent pages in search results for unrelated product keywords. By contaminating search engine results, the attackers cause compromised websites to appear prominently in search queries for products that the sites do not actually sell, tricking users into visiting malicious platforms.