Fake Download Sites: How Malvertising and SEO Poisoning Deliver Malware

 

You need a PDF editor, a video converter, or a copy of a tool you have used for years. You search for it, click one of the first results, download the installer, and run it. The program even works. Weeks later your bank calls about a login from another country.

This is malvertising and SEO poisoning — two techniques that place criminal download pages exactly where you look for legitimate software. They do not rely on you clicking a suspicious link in an email. They rely on you searching for something completely reasonable and trusting what appears at the top.

The uncomfortable part: the top of a search results page is not a ranking of trustworthiness. Part of it is an auction, and the rest can be manipulated.

How the Two Techniques Work

Malvertising: buying the top slot

Search ads are sold at auction. Anyone with a payment method can bid on a brand name they do not own. Criminals buy ads for terms like the names of popular free tools, then point the ad at a pixel-perfect clone of the official website. The displayed URL in the ad can look correct while the actual destination differs, and the landing page is often a copy of the real site scraped an hour earlier.

Ad platforms remove these campaigns, but the economics favour the attacker: a campaign that runs for six hours before takedown can pay for itself many times over. New accounts appear as fast as old ones are banned.

SEO poisoning: earning the top slot dishonestly

The organic-results version is slower but harder to remove. Attackers compromise legitimate websites — often neglected small-business sites and abandoned blogs running outdated plugins — and quietly plant thousands of pages targeting phrases like "software name crack," "free download," "license key," or "template download."

Because those pages sit on domains with real age and real backlinks, they rank. The visitor lands on a page that looks like a file-sharing site, clicks download, and receives an installer that is genuinely functional software with an information-stealer bundled alongside it.

What actually gets installed

The dominant payload today is an infostealer. It runs once, quickly, and then usually deletes itself. In those few seconds it copies:

• Every password saved in your browser
• Session cookies — which let an attacker resume your logged-in sessions without your password and often without triggering two-factor authentication
• Autofill data: addresses, card details, phone numbers
• Cryptocurrency wallet files and browser wallet extensions
• A screenshot and a list of installed applications

That package is uploaded and sold. Because the malware removes itself, your antivirus scan a week later comes back clean and you conclude nothing happened. This is why the consequence often arrives months after the cause, and why people rarely connect the two.

Warning Signs Before You Click Download

The result is an ad

Sponsored results carry a small "Sponsored" or "Ad" label. That label is not a verdict, but for software downloads specifically, it is a reason to scroll past. There is no upside to using an ad to reach a site whose address you can type yourself.

The domain is almost right

Look carefully at the address bar after landing. Attackers register lookalikes: an extra hyphen, a swapped letter, .app or .download in place of .com, or the real brand name pushed into a subdomain such as vlc.secure-downloads.net. The real domain is always the part immediately before the first single slash.

The page pushes a downloader, not the program

Files named setup_launcher, download_manager, or an installer of only a few hundred kilobytes for a large application are stubs designed to fetch whatever the operator chooses at that moment. Legitimate projects publish the actual build with a matching size.

The file type does not match

Desktop software arrives as .exe, .msi, .dmg, .pkg, or a plain archive. Treat these as immediate red flags: a .iso or password-protected .zip for an ordinary utility (both are used specifically to evade scanning), or any instruction to run a command you copy from the page into a terminal or the Windows Run box. That last one — sometimes disguised as a "verify you are human" step — is now one of the most common infection routes on the web.

The page tells you to disable your antivirus

There is no legitimate reason. "Turn off Windows Defender before installing" and "add an exclusion for this folder" are instructions written by the person who wants to infect you.

How to Download Software Safely

1. Go to the source, typed by hand. Type the vendor's domain directly, or use a bookmark you created earlier. For open-source projects, use the official repository releases page rather than a mirror you found through a search.
2. Prefer an official store or package manager. The Microsoft Store, the Mac App Store, winget on Windows and Homebrew on macOS all pull from verified sources. This eliminates the search step entirely, which is where the attack lives.
3. Check the publisher signature. On Windows, right-click the installer → Properties → Digital Signatures and confirm the signer is the company you expect. On macOS, an unsigned app triggers a Gatekeeper warning — do not right-click your way past it for something you just downloaded.
4. Scan before running. Upload the file to VirusTotal. A handful of detections on a well-known tool can be a false positive; a dozen detections mentioning "stealer" or "trojan" is not.
5. Never install cracked or "activated" software. There is no honest business model for someone distributing paid software for free. The payload is the product.
6. Use an ad blocker. Blocking search ads removes malvertising as a delivery route outright — the single highest-value change on this list.
7. Keep browser password storage minimal. A dedicated password manager with a master password is far harder for an infostealer to harvest than the browser's built-in store, which is designed for convenience rather than resistance.

If It Already Happened

Assume everything the browser knew has been copied. Work in this order — the sequence matters, because changing passwords on an infected machine simply hands over the new ones too.

1. Disconnect the device from the internet to stop further uploads.
2. Change critical passwords from a different, clean device — phone or another computer. Start with email, then banking, then anything storing payment details.
3. Sign out of all sessions everywhere. This is the step people miss, and it is the important one. Stolen cookies keep an attacker logged in even after a password change. Google, Microsoft, Apple, Meta and most banks all offer a "sign out of all devices" or "revoke active sessions" control in security settings.
4. Rotate two-factor methods if the account allows it, and review authorised apps and recovery email addresses for entries you did not add.
5. Run a full scan with Microsoft Defender or a reputable second-opinion scanner such as Malwarebytes. Expect it to find nothing if the stealer self-deleted — that is not reassurance.
6. For anything financially sensitive, reinstall the operating system. It is the only way to be certain, and it is a few hours rather than a few months of consequences.
7. Move any cryptocurrency to a newly generated wallet. Wallet files and seed phrases stored on the machine must be treated as compromised permanently.

The Bottom Line

Malvertising and SEO poisoning succeed because they attack the moment you are doing something completely ordinary. There is no suspicious email to spot and no obvious mistake to avoid — the only error is trusting position on a results page as a proxy for legitimacy.

The fix is a habit, not a product: never reach a download through a search result. Type the vendor's address, use a package manager, or use a bookmark. And if any page ever asks you to disable your antivirus or paste a command to prove you are human, close the tab. That is not a hurdle — that is the attack.