Poisoning the Well: Banking Trojan Targets Google Search Results
Summary: Cisco Talos reported that attackers used SEO poisoning of Google search results for banking-related keywords - including queries such as "al rajhi bank working hours in ramadan" and "how to cancel a cheque commonwealth bank" - to rank malicious links, often several times on page 1, and deliver the Zeus Panda banking trojan. The campaign used compromised business websites with star ratings, a multi-stage JavaScript redirect chain employing 302 cushioning, and a malicious Word document whose obfuscated macros downloaded a PE32 executable from settleware[.]com into the %TEMP% directory.
Why it matters: The initial vector was not email but search results targeting financial keywords in India and the Middle East, so an employee searching for bank account or salary slip information can land on a compromised, highly rated site and never trigger an email gateway.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026