San Jose, Calif.-based Cisco Talos revealed threat actors usedsearch engine optimization to target specific users with the ZeusPanda, a banking Trojan designed to steal banking andother sensitive credentials.

The attackers used malicious links more prevalent in Googlesearch results to target numerous keyword groups, with mosttailored towards banking or financial-related information thatpotential victims might search. By poisoning the results forbanking and financial keywords, the attackers were able toeffectively target an audience that regularly uses financialplatforms, providing the attacker a quicker way to obtaincredentials, banking and credit card information.

By targeting primarily financial-related keyword searches andensuring the display of malicious results, the attacker alsomaximized the potential conversion rate of their infections, theblog post authored by Edmund Brumaghin, Earl Carter and EmmanuelTacheau strongly suggested. “They can be confident that infectedusers will be regularly using various financial platforms and thuswill enable the attacker to quickly obtain credentials, banking andcredit card information, etc.”