{"id":2827,"date":"2025-09-15T19:55:18","date_gmt":"2025-09-15T19:55:18","guid":{"rendered":"https:\/\/ft365.org\/index.php\/2025\/09\/15\/seo-poisoning-targets-chinese-users-with-fake-software-sites\/"},"modified":"2025-09-15T19:55:18","modified_gmt":"2025-09-15T19:55:18","slug":"seo-poisoning-targets-chinese-users-with-fake-software-sites","status":"publish","type":"post","link":"http:\/\/ft365.org\/index.php\/2025\/09\/15\/seo-poisoning-targets-chinese-users-with-fake-software-sites\/","title":{"rendered":"SEO Poisoning Targets Chinese Users with Fake Software Sites"},"content":{"rendered":"
\n

A search engine optimization (SEO) poisoning attack aimed at Chinese-speaking Microsoft Windows users has been identified by security researchers.<\/p>\n

The campaign, discovered by FortiGuard Labs, manipulated search results to display fraudulent websites that closely resembled legitimate software providers, luring victims into downloading malware.<\/p>\n

Malware Disguised as Trusted Applications<\/h2>\n

Attackers registered lookalike domains and used subtle character substitutions to mislead users. Once victims landed on spoofed websites, they were prompted to install compromised versions of popular applications. These installers contained both legitimate software and hidden malware, which made\u00a0infections harder to detect.<\/p>\n

\u201cThese spoofed sites were boosted using SEO techniques to rank highly in search results, ensuring infection as users trust top-ranking results,\u201d\u00a0explained Mayuresh Dani, security research manager at Qualys Threat Research Unit.<\/p>\n

\u201cThe end result, as always, is installation of malware, in this case \u2013 Hiddengh0st and Winos malware variants by including legitimate applications to confuse security solutions.\u201d<\/p>\n

One of the key tools used in the campaign was a script called \u201cnice.js.\u201d This script managed a multi-step redirection chain, eventually leading users to download malicious installers.<\/p>\n

During analysis, researchers focused on a fake DeepL installer, which included malicious components like \u201cEnumW.dll\u201d and multiple archive fragments disguised within the setup package.<\/p>\n

Read more on malware distribution: USB Malware Campaign Spreads Cryptominer Worldwide<\/em><\/p>\n

Anti-Analysis Tactics and Data Theft<\/h2>\n

The malware also incorporated extensive checks to avoid detection. EnumW.dll, for example, validated whether it was launched by the Windows Installer process, and performed time-based and hardware integrity tests to evade sandbox environments.<\/p>\n

After these checks, it reconstructed hidden files, deployed them across system directories and executed functions that triggered further infections.<\/p>\n

Once active, the malware established persistence in several ways, including:<\/p>\n