Malvertising and SEO poisoning put attacker-controlled pages above the real result when someone searches for a tool, a template or a login page, so the user walks to the malware themselves. No email gateway sees the lure, the click happens in a normal browsing session, and the download looks like the software the user asked for. The usual payloads are information stealers, remote access tools and loaders that hand access to ransomware affiliates. This guide covers how paid-ad and search-ranking abuse work, where they show up, how to detect them on endpoints and in web telemetry, and the controls that matter most: approved download sources, application control, browser reputation enforcement and ad blocking policy. It is written for SOC analysts, endpoint and desktop engineers and security architects.
Key takeaways
- Search is now an initial access vector. MITRE ATT&CK tracks both as resource development: T1583.008 Malvertising and T1608.006 SEO Poisoning, leading to T1189 Drive-by Compromise or T1204.002 Malicious File.
- The FBI warned about this in December 2022. PSA I-122122-PSA described search ads using lookalike domains to serve malware named after the program the user wanted, and told businesses to tell users where legitimate downloads are.
- Approved download sources beat user vigilance. A software catalogue, a managed package source and application control remove the reason to search for installers at all.
- Ad blocking is a policy decision, not a plug-in. CISA lists ad blocking, browser standardisation, browsing isolation and protective DNS as the four approaches, and warns that ad blockers run with high privileges.
- Treat a hit as a credential incident. Stealers take passwords, cookies and tokens within minutes, so containment includes revoking sessions and rotating secrets, not just reimaging.
How the attack works
Malvertising (T1583.008)
The attacker buys ads through a search or display network, often using a cloaking service that shows reviewers and security crawlers a harmless page and shows targeted users the malicious one. The ad's visible URL may look right while the click goes through one or more redirectors to a cloned download page on a lookalike domain. Display malvertising on ordinary websites needs no search at all: CISA notes that malicious ads can compromise a device without the user clicking, and Microsoft's March 2025 analysis of the Storm-0408 campaign described redirectors embedded in iframes on illegal streaming sites, four to five layers of redirection, and payloads hosted on GitHub, with others on Discord and Dropbox. Microsoft estimated nearly one million devices were affected.
SEO poisoning (T1608.006)
Instead of paying, the attacker games organic ranking. Typical methods are compromising legitimate, well-ranked sites (often WordPress) and adding pages targeting long-tail queries, keyword stuffing, link farms and fake forum threads. Gootloader is the best documented example: The DFIR Report described a victim who searched for a plea agreement, clicked the second result, landed on a forum-style page on a compromised site, and downloaded a zip containing a JavaScript file. When Gootloader returned in November 2025 after a seven-month pause, researchers reported a custom web font that makes the page source unreadable to keyword scanners and malformed ZIP files that extract a script in Windows Explorer but a harmless text file in other tools.
The common chain
- User searches for software, a document template, a file converter or a vendor login.
- A sponsored or poisoned result leads, often through redirects and filtering, to a lookalike download page.
- The user downloads an installer (MSI, EXE, MSIX), a script in an archive, or a trojanised copy of the real application that also installs the payload.
- The payload runs as the user: a stealer, a remote monitoring and management (RMM) tool used as a remote access trojan, or a loader.
- Stolen credentials and session tokens are sold or used directly; loader access is handed to hands-on-keyboard operators.
Where it shows up
| Lure category | Why it works | Typical payload |
|---|---|---|
| Popular free and IT admin tools (remote access, archive tools, SSH and FTP clients, password managers) | Users and admins download them often and expect an installer | Trojanised installer with stealer or loader |
| Legal and business templates (agreements, contracts, forms) | Long-tail queries are easy to rank for | Script in archive (Gootloader) |
| Free file converters | The conversion often works, so victims suspect nothing; the FBI Denver field office warned in 2025 about converters delivering malware including ransomware | Stealer, ransomware, adware or browser hijacker |
| Cryptocurrency exchanges and wallets | Login details lead straight to funds, as the 2022 FBI PSA noted | Credential phishing page or drainer |
| Corporate portals (payroll, banking, SaaS logins) | Users search instead of bookmarking | Credential and session theft. See the AiTM Phishing Guide |
| Streaming, piracy and gaming sites | Aggressive ad networks and redirect chains | Stealer, tech support scam |
Developers and administrators deserve particular attention: they install tools often, frequently hold local administrator rights and keep cloud keys, SSH keys and tokens on the same machine.
Impact
- Credential and session theft: infostealers collect browser passwords, cookies, crypto wallets and saved tokens. Session cookies can bypass MFA until they expire or are revoked. See the Infostealer Threat Guide. Stolen logins from infostealer logs, whatever the original infection route, were behind the Snowflake customer breaches where accounts lacked MFA.
- Machine credential exposure: on developer and admin endpoints the same stealers take API keys, cloud CLI credentials, CI tokens and SSH keys. These are non-human identities that outlive the user's password reset unless they are rotated.
- Ransomware precursor: in the Gootloader case analysed by The DFIR Report, SharpHound ran about 15 minutes after execution; in the 2025 wave, reconnaissance began within 20 minutes and a domain controller was compromised within 17 hours.
- Persistent remote access: legitimate RMM tools such as NetSupport, deployed by the payload, can look like normal IT software.
Detection
| Signal | Source | What to look for |
|---|---|---|
| Download origin | Proxy or secure web gateway logs, browser download history, Mark of the Web zone identifier | Installers downloaded from domains outside the approved list, especially newly registered or recently seen domains |
| Ad and redirect chains | Proxy logs, DNS logs | Clicks through ad-network click URLs followed by several short-lived redirector domains, then a file download |
| Script launch from downloads | EDR process telemetry | wscript.exe or cscript.exe running a .js file from a user's Downloads or a temporary ZIP extraction folder |
| Microsoft Defender ASR events | Advanced hunting action types | AsrScriptExecutableDownloadAudited or Blocked, AsrUntrustedExecutableAudited or Blocked, AsrObfuscatedScriptAudited or Blocked |
| Post-execution behaviour | Windows and PowerShell logs | PowerShell event ID 4103 module logging, service installation event 7045, encoded PowerShell, new scheduled tasks, living-off-the-land binaries such as MSBuild.exe and RegAsm.exe making network connections |
| Unexpected RMM tools | Software inventory, EDR | RMM agents not on the approved list, or approved tools connecting to unknown relay servers |
| Credential use after infection | Identity provider sign-in logs | Session reuse from new IPs or devices shortly after a suspicious download on the user's endpoint |
Metrics
- Share of software installs on managed endpoints that came from approved sources (catalogue, managed package source, store) rather than the web.
- Number of executables and scripts blocked by application control or ASR rules from user-writable paths per month, and the trend after pilot rings move to enforce.
- Percentage of managed browsers with reputation enforcement on and warning bypass disabled.
- Median time from a suspicious download alert to session revocation and secret rotation for the affected user and machine.
- Number of users with standing local administrator rights, which should fall.
Prevention and hardening
Approved download sources
- Publish a software catalogue: a self-service portal (Intune Company Portal, Configuration Manager Software Center, Jamf Self Service or similar) so users never need to search for installers. The FBI's 2022 advice to businesses was to tell users where legitimate downloads are available.
- Control package manager sources: Windows Package Manager (WinGet) uses the msstore source and a community repository by default, and its Group Policy templates include Source Control settings to allow or block sources. Point managed devices at an internal or curated source. Apply the same idea to Homebrew, Chocolatey, npm and PyPI through internal mirrors.
- Remove standing admin rights: users without local administrator rights cannot install most per-machine software. Use an elevation workflow for exceptions.
Application control
- Allowlist by publisher and path: App Control for Business (formerly WDAC) or AppLocker on Windows, and equivalent controls on macOS, block unsigned or unknown executables from user-writable paths. Start in audit mode, review a few weeks of events with a pilot ring, then enforce in rings with a documented rollback (revert the policy to audit). See the Application Allowlisting Guide.
- ASR rules: in Microsoft Defender for Endpoint, enable "Block JavaScript or VBScript from launching downloaded executable content" (GUID
d3e037e1-3eb8-44c8-a917-57927947596d), "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" (01443614-cd74-433a-b99e-2ecdc07bfc25) and "Block execution of potentially obfuscated scripts" (5beb7efe-fd9a-4556-801d-275e5ffc04cc). The DFIR Report noted the first rule would have stopped the Gootloader chain at the first step. The prevalence and obfuscation rules need cloud-delivered protection. - Change the default handler for scripts: associating
.js,.jse,.vbsand.wsfwith a text editor stops double-click execution for most users. - Restrict RMM tools: allow only the organisation's approved RMM product and block others, as Microsoft recommended after the Storm-0408 campaign.
Browser and network controls
| Control | Setting or approach | Notes |
|---|---|---|
| Microsoft Defender SmartScreen | MDM Browser/PreventSmartScreenPromptOverride and Browser/PreventSmartScreenPromptOverrideForFiles set to 1; SmartScreen/PreventOverrideForFilesInShell set to 1 | Stops users clicking through site and download warnings. SmartScreen does not check files on internal network shares |
| App Install Control | SmartScreen CSP EnableAppInstallControl or GPO "Configure App Install Control" | Limits app installs to the Microsoft Store where that suits the role |
| Ad blocking | Managed browser extension or network-level filtering, deployed by policy | CISA warns extensions run with high privileges and some sell allowlisting to advertisers; check list maintainers and least privilege |
| Protective DNS | Resolver that blocks malicious and newly registered domains | Catches redirector and payload domains. See the DNS Security Guide |
| Web filtering | Block uncategorised and newly seen domains for executable downloads; block file-sharing and code hosting downloads of executables where not needed | See the Secure Web Gateway and Web Filtering Guide |
| Browsing isolation | Local sandbox or remote browser isolation for high-risk categories | Highest initial cost in CISA's list. See the Remote Browser Isolation Guide |
Choosing controls by organisation size
- Small organisations: remove local admin rights, turn on SmartScreen or the browser's equivalent with bypass disabled, publish a short approved-software list, and use a protective DNS service. These give most of the benefit with little operational load.
- Large organisations: add application control in enforce mode, ASR rules, a managed ad blocking policy, isolation for high-risk categories, and detections that link download events to identity sign-in anomalies. Developer workstations need their own policy, because blanket allowlisting breaks build tooling; use internal package mirrors and separate credentials instead.
- Trade-off: ad blocking can break sites that depend on ads and adds a privileged extension to every browser; application control has the highest prevention value but needs exception handling. Where you can only do one, application control plus approved sources removes the payload's ability to run whatever the lure.
Response to a confirmed hit
- Isolate the endpoint and preserve the downloaded file, browser history and proxy logs showing the ad or search referrer.
- Revoke all sessions and refresh tokens for the user, and reset passwords from a clean device.
- Rotate every machine credential that was reachable from the endpoint: API keys, cloud CLI profiles, SSH keys, CI and package publish tokens.
- Block the domains and file hashes, report the ad to the ad network and the lookalike domain to its registrar.
- Hunt for the same download across the estate.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1583.008, T1608.006, T1608.004, T1189, T1204.002, T1036.008 | Buying ads, poisoning search, staging drive-by targets, drive-by delivery, user execution, disguised file types |
| MITRE D3FEND | D3-EAL Executable Allowlisting, D3-URA URL Reputation Analysis, D3-DNSDL DNS Denylisting | Blocking unapproved executables and malicious destinations |
| NIST SP 800-53 Rev. 5 | CM-7(5) Authorized Software, CM-11 User-installed Software, SI-3 Malicious Code Protection, SC-7 Boundary Protection, SC-18 Mobile Code | Allowlisting, install restrictions, anti-malware, filtering, script control |
| NIST CSF 2.0 | PR.PS-05, DE.CM-09 | Preventing unauthorised software and monitoring endpoints |
| CIS Controls v8.1 | 2.5 Allowlist Authorized Software, 9.2 Use DNS Filtering Services, 9.3 Maintain and Enforce Network-Based URL Filters, 10.1 Deploy and Maintain Anti-Malware Software | Software and web controls |
| ISO/IEC 27001:2022 Annex A | 8.19 Installation of software on operational systems, 8.23 Web filtering, 8.7 Protection against malware | Controlled installation and web protection |
Common failure patterns
- Relying on "check the URL" training. Ads can display a plausible URL and redirect elsewhere; training helps but cannot be the main control.
- Letting users click through reputation warnings. SmartScreen and browser warnings work only when bypass is disabled by policy.
- Allowlisting by file hash only. Trojanised installers of real software change hashes with each campaign; publisher and path rules plus reputation checks are more durable.
- Reimaging without rotating secrets. The stolen cookies and keys keep working after the laptop is clean.
- Exempting developers from everything. The users who install the most tools and hold the most machine credentials end up with the fewest controls.
Practitioner checklist
- Publish a self-service software catalogue and a list of approved download sources, and tell users about it.
- Restrict managed package manager sources (WinGet Source Control, internal mirrors).
- Remove standing local administrator rights and provide an elevation workflow.
- Deploy application control in audit mode, pilot, then enforce in rings with a rollback plan.
- Enable the three ASR rules above in audit, then block, and alert on the matching action types.
- Disable SmartScreen warning bypass for sites, downloads and shell files.
- Decide and document the ad blocking policy, including which product, who maintains its lists and how exceptions work.
- Use protective DNS and block executable downloads from newly seen and uncategorised domains.
- Build a response runbook that revokes sessions and rotates machine credentials on every confirmed hit.
Standards and references
- FBI IC3: Cyber Criminals Impersonating Brands Using Search Engine Advertisement Services to Defraud Users
- CISA: Securing Web Browsers and Defending Against Malvertising for Non-Federal Organizations
- MITRE ATT&CK: Acquire Infrastructure: Malvertising
- MITRE ATT&CK: Stage Capabilities: SEO Poisoning
- Microsoft Learn: Attack surface reduction rules reference
- Microsoft Learn: Available Microsoft Defender SmartScreen settings
- Microsoft Threat Intelligence: Malvertising campaign leads to info stealers hosted on GitHub
- The DFIR Report: SEO Poisoning, A Gootloader Story
Related NHI Mgmt Group resources: Security Awareness and Human Risk Management Guide · Phishing Guide · EDR Guide · Crypto Scam and Drainer Guide