Cybercriminals are hacking Google Looker Studio to place their malicious websites high on the search engine’s results pages, promoting spam, pirated content, and torrents.
The campaign uses a technique known as SEO poisoning. This method uses legitimate website copy and fills it with links leading to these malicious sites. In the eyes of Google’s search engine algorithm, the links give the spam sites enough credibility for the tool to rank them high for specific keywords.
This specific attack uses Google’s datastudio.google.com subdomain.
Fake blockbuster movie downloads
BleepingComputer says it found multiple pages of Google search results “flooded with datastudio.google.com links”, after being tipped off by a concerned reader. The links don’t lead to an actual Google Data Studio project, but rather to websites hosting pirated content, such as current blockbuster movies (Black Adam, Black Panther: Wakanda Forever, and similar).
Before actually landing on these pages, the victims will first be redirected a couple of times, as well.
Most of the time, SEO poisoning is used to push torrent sites high on Google’s results pages for queries such as commercial software, the latest movies, or computer games. Consumers looking to save a few dollars on software and games sometimes go on shady sites promising cracks and activators which would enable them to use the products without paying for the license.
Most of the time, the activators and cracks don’t really work as advertised, and all they do is distribute viruses, or malware. These malicious programs are capable of wreaking all kinds of havoc, from installing cryptocurrency miners, to stealing sensitive data, to deploying ransomware and rendering the devices completely useless.
- Check out the best internet security suites right now
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.