Loading story…
Google has begun routing some Search-result links through opaque google.com/goto?url=... redirects instead of linking directly to destination sites. The URL parameter uses Google-specific encoding, so browser hover previews display the Google redirect rather than the final destination, limiting users’ ability to validate where a result will lead before clicking it.
Google confirmed the rollout and said it is deploying measures against evolving abuse, but did not identify the abuse being addressed. Resolving final URLs now requires an additional request and inspection of the HTTP Location response header, increasing the cost of bulk result extraction and potentially disrupting legitimate rank-tracking, SEO, research, archival, accessibility, and alternative-indexing services.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Google began routing some Google Search result links through encoded google.com/goto?url= redirects instead of directly linking to destination sites. Google confirmed the rollout, saying it deploys technical measures against evolving abuse, but did not identify the specific abuse addressed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcereddit.com
Open sourceseroundtable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are leveraging SEO poisoning by creating keyword-stuffed, cloaked doorway pages that rank highly in search results. These pages instantly redirect users to fraudulent sites, often for phishing, malware delivery, or selling counterfeit goods. The technique exploits search engine algorithms and user trust, making detection and proactive threat hunting essential.
Jun 29, 2026
Cybersecurity experts are raising awareness about the growing threat of malicious SEO tactics and SEO poisoning, which manipulate search engine results to promote fraudulent or harmful websites. These techniques include keyword stuffing, purchasing backlinks, generating fake content, and leveraging AI to mass-produce spammy or deceptive web pages. As a result, legitimate businesses and users are increasingly at risk of encountering malicious sites that appear at the top of search results, undermining trust in web search and exposing users to scams or malware. Educational campaigns, such as those by ManageEngine during Cybersecurity Awareness Month, emphasize the importance of vigilance when clicking on top search results and provide guidance on identifying signs of SEO poisoning. Security researchers recommend that search engines and content platforms implement advanced, AI-driven defenses to detect and block these manipulative tactics, as traditional spam filters and manual moderation are no longer sufficient to counter the scale and sophistication of modern SEO abuse.
Jun 29, 2026
Fortra reported a **40% increase** in cloaked “Chameleon” SEO-poisoning campaigns during the second quarter of 2026. The activity targets major financial institutions and their customers by using high-intent banking search terms to push phishing pages into prominent Google and Bing results, while showing benign content to automated scanners and other inspection systems. The campaigns use newly registered, typosquatted second-level domains rather than compromised legitimate websites, making fraudulent pages appear relevant to users seeking banking services. Organizations should warn customers and employees to reach financial portals through official mobile applications or manually saved bookmarks, rather than search-engine results, and monitor for typosquatted domains impersonating their brands.
Sep 1, 2026