Quick Summary
The Black Cat cybercrime gang has launched an SEO poisoning campaign that leads users to fraudulent sites promoting popular software, such as Notepad++. This campaign has been active since at least 2022 and has compromised approximately 277,800 hosts in China between January 7 and January 20, 2025. The malware involved can steal sensitive data, highlighting significant risks for users downloading software from untrusted sources.
The Securityish Brief
The Black Cat cybercrime group is behind a sophisticated search engine optimization (SEO) poisoning campaign aimed at tricking users into downloading malware disguised as popular software. This campaign has been reported by the National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC) and Beijing Weibu Online (ThreatBook). The group has been active since at least 2022, with a focus on stealing sensitive data through backdoor Trojans.
In the latest attacks, users searching for software like Notepad++ are directed to phishing sites, including ‘cn-notepadplusplus[.]com’. Other domains used by Black Cat include ‘cn-obsidian[.]com’ and ‘cn-winscp[.]com’. These sites are designed to appear legitimate, pushing users to download malicious software that can compromise their systems.
Once users click on the download button, they are redirected to a URL that mimics GitHub, from which a ZIP file containing an installer is downloaded. This installer creates a desktop shortcut that, when executed, side-loads a malicious DLL, establishing a backdoor for attackers. The malware can steal web browser data, log keystrokes, and extract clipboard contents.
Between January 7 and January 20, 2025, the Black Cat group reportedly compromised around 277,800 hosts in China, with a peak of 62,167 compromised machines in a single day. This indicates a significant scale of operation targeting users looking for software through search engines.
In 2023, Black Cat was also involved in stealing at least $160,000 worth of cryptocurrency by impersonating AICoin, a popular virtual currency trading platform. This highlights the group’s ongoing focus on financial gain through cybercrime.
Understanding the Risks of SEO Poisoning
This incident underscores the risks associated with downloading software from unverified sources. Users are often unaware of the potential dangers lurking behind seemingly legitimate links. The use of SEO tactics to promote malicious sites is a growing concern in cybersecurity.
Organizations and individuals must be vigilant about the sources of their downloads. Ensuring that software is obtained from official websites or trusted platforms can help mitigate the risk of falling victim to such attacks. Regularly monitoring for unusual activity on devices can also provide an additional layer of security.
Key Takeaways
- Always download software from official websites or trusted sources to avoid malicious downloads.
- Be cautious of links in search results, especially those that appear suspicious or unfamiliar.
- Regularly monitor your devices for unusual activity or unauthorized access.
- Keep your operating system and software updated to protect against vulnerabilities.
- Consider using security software that can detect and block malware threats.
Key Terms & Concepts
- SEO Poisoning: In this article, SEO poisoning refers to a tactic used by cybercriminals to manipulate search engine results, leading users to malicious sites.
- Backdoor Trojan: A backdoor Trojan is a type of malware that allows unauthorized access to a user’s system, often without their knowledge.
- CNCERT/CC: CNCERT/CC stands for the National Computer Network Emergency Response Technical Team/Coordination Center of China, which monitors and responds to cybersecurity incidents.
- Black Cat: Black Cat is a cybercrime group known for orchestrating attacks aimed at data theft and financial gain through malware.
- Phishing: Phishing is a fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity in electronic communications.
Read the original article here: https://thehackernews.com/2026/01/black-cat-behind-seo-poisoning-malware.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
