SEO Poisoning Phishing Guide

SEO poisoning is a black hat SEO tactic that makes malicious or deceptive pages appear where people expect trustworthy search results. In phishing campaigns, attackers use hacked websites, lookalike domains, doorway pages, fake reviews, and keyword-stuffed content to push users toward counterfeit login pages, fake downloads, support scams, or payment forms.

The danger is not only that a fake page exists. The danger is that it borrows trust from search: a result may look relevant, recent, and connected to a familiar brand while the click actually leads to credential theft, malware, or a scam. For website owners, the same technique can also damage a domain’s reputation if attackers inject spam pages or redirects into a legitimate site.

What Is SEO Poisoning?

SEO poisoning, also called search poisoning, is the use of deceptive ranking tactics to place harmful pages in search results. It overlaps with black hat SEO because the attacker is not trying to earn rankings with useful content. They are manipulating signals, abusing compromised sites, or creating pages that exist mainly to intercept searches.

Google’s spam policies describe several tactics that appear in these campaigns, including hacked content, cloaking, doorway abuse, keyword stuffing, and site reputation abuse.[1] In phishing cases, those tactics are used to make a malicious page look like the right answer at the exact moment a user is searching for help, a login page, a brand name, or a software download.

How Black Hat SEO Becomes Phishing

This is why the phrase “black hat SEO phishing” matters. The SEO manipulation is the delivery mechanism; phishing, malware, or fraud is the payload. A user can make a careful search and still be pushed toward a harmful page if the attacker has temporarily won visibility for the wrong result.

BengalSEO and MayaBot: a search-to-support-scam example

On August 24, 2026, The DFIR Report described an operation it calls BengalSEO, which uses poisoned search results and fake support or activation pages to deliver malware or funnel visitors into phone scams. Its researchers named the operation’s custom malware MayaBot. The observed lures included tax software, antivirus support, gaming downloads, streaming activation, and card services.[6]

The important recognition clue is the sequence. A visitor may encounter a real CAPTCHA service, pass through several redirects, and download a ZIP containing a JavaScript file disguised as an executable. The report describes a later redirect to the legitimate software page, which can make the earlier download seem trustworthy. Other visitors receive a benign page or a phone-contact route. A familiar brand, successful challenge, or eventual arrival on an official site therefore does not validate the file or number supplied earlier. These are observations from this campaign, not proof that every support page or similarly named file is MayaBot.

Warning Signs in Search Results

• The domain is slightly misspelled, has extra words, or uses an unexpected country-code or cheap top-level domain.
• The result promises a “latest version”, “account verification”, “refund”, “support number”, “free license”, or “urgent fix” but is not on the official brand domain.
• The URL includes strange folders, random characters, unrelated languages, casino terms, pharma terms, or many query parameters.
• The page asks you to run a command, paste a script, install a browser extension, allow notifications, or pass a fake CAPTCHA before you can continue.
• The page has HTTPS but the certificate only proves an encrypted connection to that domain, not that the domain is legitimate.
• The page copies a familiar interface but the footer, privacy links, contact details, or internal links lead nowhere useful.

When in doubt, do not click the result again. Type the known address manually, use a saved bookmark, or search the official vendor’s site directly. For suspicious domains, you can check the URL with Gridinsoft Website Reputation Checker before entering information.

If You Clicked a Poisoned Result

Choose the furthest step you actually took. A page visit, file download, executed program, and remote-support session create different response needs; do not treat all of them as confirmed malware execution.

1. You only viewed or closed the page. Keep it closed. Save the URL from browser history and an existing screenshot if useful, without reopening the lure. Check the browser’s download list and remove any notification permission you granted. If nothing downloaded, ran, or was entered, the documented MayaBot delivery path alone does not establish an infection.
2. You passed a challenge. Stop before the next button. A real CAPTCHA checks a visitor; it does not certify the site. If the instructions made you paste a command, run a file, install an extension, or grant access, follow the corresponding execution or remote-access steps below.
3. You clicked a support or download button. Check whether it started a download, opened another site, or displayed a phone number. Do not call that number or finish a login, payment, or support chat. Reach the vendor through a saved bookmark or an independently verified official address. A later redirect to the real vendor does not make the earlier interaction safe.
4. A ZIP downloaded, but you did not run its contents. Leave it unopened; do not test it to see what happens. Record the filename and source URL, then quarantine or delete the unwanted download. On a work device, let IT preserve the sample through its approved process. Downloading alone is different from running the disguised script.
5. You ran the file or installed an extension. Disconnect the affected Windows PC from networks and stop using it for sensitive accounts. Preserve alert details and notify IT on managed devices. Scan for malware, review installed extensions and programs, and check persistence before returning to normal use. A script can run without showing a convincing installer window.
6. You called or granted remote access. End the call. If you only spoke, act on any information you disclosed; a phone call alone does not install the reported payload. If someone controlled the computer, disconnect it, record the remote-tool name, remove unauthorized access after preserving evidence, and check for unattended access or new accounts. For a page claiming your PC is infected, use the fake virus alert response guide. The FTC advises using a known, genuine support contact rather than the number in an unexpected message.[7]
7. You paid or exposed account details. Contact your bank or payment provider promptly through a trusted channel and ask about stopping or disputing the transaction. Keep receipts, messages, URLs, and call details. From a clean device, change exposed and reused passwords, starting with email, banking, cloud, work, marketplace, crypto, and social accounts. Sign out other sessions and review MFA, unknown devices, app passwords, forwarding rules, OAuth grants, and recovery phone/email changes. Apply these account checks after file execution or remote access too when those accounts may have been exposed.

If a downloaded file or remote tool ran, removing the visible download may leave a loader, scheduled task, service, browser change, or other persistence. After containment, run a full Gridinsoft Anti-Malware scan, review and remove detections, reboot when appropriate, and scan again if symptoms return. A malware scan does not reverse a payment or restore control of an exposed account; complete those recovery steps separately. The Windows security audit after malware covers the checks before trusting the device again.

If the page was an email or account scam rather than a download, compare the signs with our phishing vs spoofing guide. If the click installed an extension or changed browser behavior, also review why a browser extension keeps reinstalling.

If Your Site Was Used for SEO Spam

For site owners, the first goal is to confirm whether attackers actually changed your site or only used a lookalike domain. Search for your brand with suspicious terms such as “login”, “support”, “download”, “coupon”, “casino”, “crypto”, “refund”, or a phone number. Then inspect the live URL as both a normal visitor and a crawler-visible HTML page.

Do not simply delete visible spam and stop. Remove the entry point, rotate passwords and API keys, update the CMS and plugins, check file permissions, review server logs, and make sure a backup is clean before restoring it. CISA’s website security guidance notes that compromised web servers can be abused for defacement, malware distribution, or attacks on others, which is why cleanup should include the server and application layers, not only one page.[4]

How to Clean Up Poisoned Pages

1. Take a backup for evidence. Preserve logs, modified files, suspicious URLs, user lists, and timestamps before cleaning.
2. Remove injected content and redirects. Delete spam pages, malicious scripts, cloaked templates, fake sitemaps, and unknown plugin files.
3. Return the right status codes. Use 404 or 410 for removed spam URLs. Do not redirect spam URLs to the homepage just to hide the problem.
4. Patch the entry point. Update vulnerable plugins, themes, CMS core, server packages, and remove abandoned components.
5. Rotate credentials. Change admin passwords, database passwords, SSH keys, FTP/SFTP credentials, API keys, and hosting-panel accounts.
6. Request review only after cleanup. If Search Console shows a security issue or manual action, document the fix and submit the appropriate review from Search Console.
7. Watch recrawl data. Google reports can lag behind live fixes. Track affected URL patterns, crawl activity, and fresh search results rather than assuming recovery is instant.

How to Reduce Future Risk

• Keep WordPress, plugins, themes, and server software updated; remove plugins you no longer use.
• Use MFA for admin, hosting, registrar, CDN, and Search Console accounts.
• Limit write permissions and disable direct file editing where possible.
• Monitor new indexed pages, top queries, unexpected landing pages, and sudden spikes in impressions for unrelated keywords.
• Keep XML sitemaps clean and avoid indexing thin search, tag, parameter, or internal-result pages.
• Use canonical tags correctly, but do not treat canonical as a security control. It helps search engines understand preferred URLs; it does not stop attackers from publishing spam.
• Create clear official pages for downloads, login, support, refund, and security-contact information so users have a trustworthy result to verify against.

For brands, prevention also means teaching users what legitimate communication looks like. If attackers imitate your login page or support flow, publish a short security notice that explains your real domains, real support channels, and what you will never ask for. That notice can outrank rumors and give victims a safer next step.

Why This Page May Not Show for Every Google Query

A page can be accessible, indexable, and still not appear for a specific search. Google explains that an indexed or inspectable URL can appear in Search, but that status is not a guarantee of visibility for every query.[5] For this topic, Google often rewards pages that answer the current practical problem: poisoned results, compromised sites, fake downloads, phishing recovery, and Search Console cleanup. A generic definition of “black hat SEO” is usually not enough.

FAQ

References

1. Google Search Central. “Spam Policies for Google Web Search.” Google, accessed June 6, 2026. https://developers.google.com/search/docs/essentials/spam-policies
2. Google Search Console Help. “Why Is My Site Labeled as Dangerous in Google Search?” Google, accessed June 6, 2026. https://support.google.com/webmasters/answer/6347750
3. Google Search Console Help. “Manual Actions Report.” Google, accessed June 6, 2026. https://support.google.com/webmasters/answer/9044175
4. CISA. “Website Security.” Cybersecurity and Infrastructure Security Agency, accessed June 6, 2026. https://www.cisa.gov/sites/default/files/publications/TIP-12-298-01-Website-Security.pdf
5. Google Search Console Help. “URL Inspection Tool.” Google, accessed June 6, 2026. https://support.google.com/webmasters/answer/9012289
6. The DFIR Report. “BengalSEO Part 1: Anatomy of the Operation.” August 24, 2026; accessed September 8, 2026. Campaign analysis
7. Federal Trade Commission. “How To Spot, Avoid, and Report Tech Support Scams.” Consumer Advice, September 2025; accessed September 8, 2026. Tech support scam response