SolarMarker Malware Uses PDF’s and SEO Keywords To Spread

Share post:

Attackers behind the malware, known as SolarMarker, use PDF documents that contain search engine optimization (SEO) keywords to increase their visibility in search engines, leading potential victims to malware on a website that mimics Google Drive.

SolarMarker is a backdoor malware that steals data and credentials from infected browsers.

The hacker’s host pages on Google pages that serve as a lure for malicious downloads.

The malicious software is primarily aimed at North American users.

Once opened, the PDFs ask users to download a doc or pdf file, which then redirects users to 7 pages of TLDs such as. site,. tk and. ga.

After several redirects, users arrive at a page that is very similar to Google Drive but actually controlled by the attackers.

The page then exfiltrates stolen data to a command-and-control server and continues by creating shortcuts in the startup folder and modifying shortcuts on the desktop.

The SEO poisoning technique seems to be very effective since Microsoft 365 Defender has blocked thousands of pdf documents in different environments.

For more information, read the original story in ZDNet.

Featured Tech Jobs


Related articles

Cyber Security Today, Dec. 4, 2023 – A warning to water treatment utilities, a boot vulnerability could affect millions of PCs, and more.

This episode  reports on a campaign against critical infrastructure using PLCs, a vulnerability in PCs

Cyber Security Today, Week in Review for Friday, December 1, 2023

This episode features a discussion on ransomware, the latest explanation from Okta of a support hack and a survey of infosec pros whose firms w

Cyber Security Today, Dec. 1, 2023 podcast – More on compromises

This episode reports on the sanctioning of the Sinbad crypto mixe

All Okta customer support users had their email addresses copied

Identity and access provider Okta now says the threat actor who accessed its customer help desk system last month got the names and email addresses of all contacts of organizations that use its support system. Originally, the company said that, after an investigation, it determined only one per cent of the contacts from its 18,000

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways