A poisoned SERP is a search engine results page (SERP) in which malicious or deceptive pages have been pushed into positions where people are likely to click them. The pages arrive by three routes: manipulation of organic rankings, usually called SEO poisoning; the hijacking of legitimate websites that already rank; and paid search ads bought under false pretences. In each case attackers exploit the trust people place in the top of a results page to deliver malware, steal credentials or route victims to scam call centres. The phrase is informal; the underlying technique is catalogued as "SEO poisoning".

How a results page gets poisoned

The organic route usually begins with a compromised website. Google's spam policies define hacked content as "any content placed on a site without permission, due to vulnerabilities in a site's security", and list four forms: code injection, page injection, content injection and redirects. Injected pages go unnoticed by the site's owner but inherit the domain's ranking history.

Those pages are tuned to narrow, low-competition queries. A 2021 Sophos analysis of the Gootloader operation, written by Gabor Szappanos and Andrew Brandt, found a Canadian medical practice ranking first on Google for "a very narrowly defined type of real estate agreement". Sophos estimated that roughly 400 hacked servers were in use at any one time.

Cloaking keeps the operation hidden. Google defines it as "presenting different content to users and search engines". In the Gootloader case, injected code checked the visitor's User-Agent string, the referrer header showing a click from a Google results page and, possibly, the visitor's location. Qualifying visitors saw a fake message board that repeated their exact search terms and offered a download from a supposed administrator. Everyone else saw filler text, and the forum appeared only if there had been "no previous visits to the website from the visitor's IP address", according to Sophos.

Gootloader's payload was a zip archive named after the search query, holding a JavaScript file whose later stages delivered the REvil ransomware, the Kronos banking trojan and Cobalt Strike. A May 26, 2026 Microsoft analysis described a different pattern: fake download sites for utilities such as CrystalDiskInfo, HWMonitor and FurMark, each serving a zip with the genuine tool alongside a malicious DLL loaded through DLL side-loading. Microsoft said it had identified more than 150 such domains since March 2026.

The paid route needs no hacking at all. On December 21, 2022, the FBI's Internet Crime Complaint Center (IC3) warned that criminals were buying search ads on domains resembling real businesses, placed "at the very top of search results" with minimal distinction from organic listings. In May 2025, security firm ReliaQuest reported that employees searching for their company's payroll portal on mobile phones were sent by sponsored links to a fake Microsoft login page; the stolen credentials were used to change direct deposit details. The mechanics overlap with malvertising, but the placement is the search page itself.

Origin and evolution

By the late 2000s, attackers were seeding results for trending queries with pages pushing fake anti-virus software. On April 14, 2010, Google's Niels Provos reported that a 13-month analysis of 240 million web pages had found more than 11,000 domains distributing fake anti-virus programs, about 15% of all malware domains Google detected in that period. Months later, the security firm Websense described "the growing problem of Black Hat SEO, or SEO Poisoning" in its annual threat report. According to Network World's account of that report, 22.4% of the Google searches Websense tracked from June 2010 returned malicious links in the top 100 results, up from 13.7% in the second half of 2009.

The focus then moved from mass-market lures to targeted ones. In November 2024, Sophos researchers including Sean Gallagher found the same operation ranking first for "Do you need a license to own a Bengal cat in Australia". Sophos described Gootloader as having evolved into "an initial access as a service platform", selling footholds to other criminals.

The industry codified the technique on September 30, 2022, when MITRE added SEO Poisoning to its ATT&CK framework as technique T1608.006, describing adversaries who "poison mechanisms that influence search engine optimization". Volume did not fall. In January 2026, China's CNCERT/CC and the security firm ThreatBook attributed about 277,800 compromised hosts in China between December 7 and 20, 2025, to a group called Black Cat, which had pushed fake installers for Chrome and Notepad++ to the top of Microsoft Bing results.

Why it matters for marketers

Brand owners see their names and download pages copied, and impersonators bid on the same branded queries in paid search. The FBI's 2022 advice to businesses was to use domain monitoring to catch look-alike registrations, the problem described in PPC Land's explainer on typosquatting.

Advertising professionals are also targets in their own right. On October 7, 2026, analytics engineer David Vallejo reported that a Google search for "cloud console" had returned an ad leading toward a credential page on a look-alike domain, a case PPC Land covered as an analytics engineer phished through a Google ad for Google Cloud Console. Earlier in 2026, fraudsters targeted Google Ads agencies with fake client leads using a domain registered for the purpose. Proxy kits can capture passwords and session cookies, the technique described in PPC Land's entry on man-in-the-middle attacks.

A third exposure is quieter. A marketing site that is hacked and used to host poisoned pages becomes a policy violation in its own right, and Google's spam policies state that violating sites "may rank lower in results or not appear in results at all". Enforcement can arrive through automated demotion by SpamBrain or a human-issued manual action.

Platforms publish enforcement totals rather than prevalence figures. Google's 2025 Ads Safety Report, released April 16, 2026, said 8.3 billion ads had been blocked or removed, including 602 million for violations most associated with scams. In March 2024, Google had tightened its misrepresentation rules against impersonation, adding immediate suspension for offenders. For organic results, a May 8, 2025 Google post said improved classifiers caught "20-times the number of scammy pages" and had cut airline customer-service impersonation scams in Search by more than 80%.

Limitations, criticisms and open disputes

Measurement is the central weakness. Most figures come from security vendors with products to sell, counting different things: hosts infected, domains registered, searches sampled. None was independently audited.

Cloaking compounds the problem. A poisoned page that shows itself once per IP address, and only to visitors arriving from a search engine, can look clean to a journalist, a regulator or a search engine's own crawler.

Platform figures carry their own ambiguity. Google says more than 99% of violating ads are stopped before anyone sees them. Applied to 8.3 billion ads, the remaining 1% could still mean tens of millions of impressions, a point raised in PPC Land's analysis of how Google suspended 38x more US ad accounts than TV had advertisers. Google's "20-times" claim is relative and comes without a published baseline.

Defensive advice is also contested. The FBI recommended that individuals install ad-blocking extensions, which protects users from fraudulent search ads but removes legitimate ones too. Attribution between search engines is uneven: the Black Cat reporting named Bing, Gootloader research focused on Google, and Microsoft's 2026 post named no engine at all.

Poisoned SERP is not the same as

SERP. On its own, the abbreviation describes any results page, organic and paid. Only the qualifier signals that something malicious is present.

Malvertising. This covers malicious ads in any channel, including display banners on publisher sites, delivered through programmatic supply chains. Microsoft's March 6, 2025 report on Storm-0408, a campaign that reached nearly one million devices through ads on illegal streaming sites, is malvertising with no search component. A malicious search ad sits in both categories.

Site reputation abuse. Google's policy on site reputation abuse concerns third-party pages published on a host site, often with the owner's consent, to borrow its ranking signals. The content is usually commercial rather than malicious, and no one has been hacked.

Black-hat SEO. This is the wider family of ranking manipulation, from link schemes to scaled content abuse. SEO poisoning is the subset that uses those techniques to deliver an attack.

Recent developments

The newest front is generative search. In a July 1, 2025 study, Netcraft asked a model from OpenAI's GPT-4.1 family where to log in to 50 brands; 34% of the 97 domains it suggested were not owned by the brand, and 29% were unregistered, parked or inactive and therefore available to attackers. In August 2025, users reported scam customer-service numbers appearing in Google AI Overviews. Microsoft's May 2026 analysis added, with lower confidence, that in April 2026 some AI chatbots had pointed users asking for software downloads to malicious domains.

In May 2026, Google's spam policies were extended to cover AI Overviews and AI Mode. Manipulative tactics aimed at AI systems, including hidden instructions behind "Summarize with AI" buttons, were described by SEO consultant Lily Ray in a May 2026 interview on what the SEO industry is getting wrong about AI search; the method is a form of prompt injection. Back button hijacking became an explicit violation enforceable from June 15, 2026.

Poisoning has also spread beyond the classic ten blue links. On July 13, 2026, PPC Land found fabricated earnings headlines on Google Finance for Criteo and Zeta Global, sourced to an Ethiopian government domain and linking to a WhatsApp investment group. The latest spam update began on September 24, 2026 and ended after nearly 14 days, on October 8. No public measure of its effect on poisoned results existed as of October 2026.

Timeline

  • April 14, 2010 - Google reports that over 13 months it found more than 11,000 domains distributing fake anti-virus software, about 15% of malware domains it detected.
  • November 2010 - Websense's annual threat report describes "Black Hat SEO, or SEO Poisoning"; 22.4% of tracked Google searches since June returned malicious links in the top 100 results, according to Network World.
  • March 1, 2021 - Sophos documents Gootloader's fake-forum technique on about 400 hacked servers.
  • September 30, 2022 - MITRE adds SEO Poisoning to ATT&CK as technique T1608.006.
  • December 21, 2022 - The FBI warns that criminals are buying search ads that impersonate brands.
  • March 2024 - Google strengthens its Misrepresentation policy against impersonation ads.
  • November 2024 - Sophos reports Gootloader ranking first for a Bengal cat legality query in Australia.
  • March 6, 2025 - Microsoft reports the Storm-0408 malvertising campaign, detected in December 2024.
  • May 8, 2025 - Google says it catches 20 times more scammy pages in Search and has cut airline impersonation scams by over 80%.
  • May 2025 - ReliaQuest reports sponsored search results leading to fake payroll logins.
  • July 1, 2025 - Netcraft finds 34% of AI-suggested login domains are not brand-owned.
  • August 2025 - Scam support numbers reported in Google AI Overviews.
  • December 7-20, 2025 - Black Cat's poisoned Bing results compromise about 277,800 hosts in China, according to CNCERT/CC and ThreatBook.
  • May 2026 - Google extends spam policies to AI Overviews and AI Mode.
  • May 26, 2026 - Microsoft reports more than 150 fake utility download domains since March 2026.
  • June 15, 2026 - Enforcement of the back button hijacking policy begins.
  • July 13, 2026 - Fake earnings headlines found on Google Finance.
  • September 24 to October 8, 2026 - Google runs its third spam update of the year.
  • October 7, 2026 - A Google Cloud Console phishing ad is reported in Google results.

Summary

Who: Criminal groups such as the Gootloader and Black Cat operators, and impersonators buying search ads, on one side; search engines, security firms, law enforcement and brand owners on the other.

What: A search results page in which malicious or deceptive pages occupy visible positions through SEO poisoning, hacked websites, cloaking or fraudulent paid placements, used to spread malware, steal credentials and run scams.

When: Documented at scale since the late 2000s fake anti-virus wave, formalised by MITRE in September 2022, and extending into AI-generated answers from 2025.

Where: Organic and paid results on Google and Bing, and increasingly in AI Overviews, chatbot answers and verticals such as Google Finance.

Why: A top search position carries implied endorsement, and people searching for a download, a login page or a support number are primed to act on the first plausible result.