Cybercriminals have revived an old Black Hat SEO technique, leveraging it to evade spam detection mechanisms and successfully distribute malicious messages.
The practice of using white text on a white background to hide content has made a comeback, with scammers now exploiting it to distribute spam messages.
Back in the early days of the internet, when SEO was still in its infancy, some developers would resort to using SEO bombs in their texts, placing a plethora of keywords in the content of the pages they wanted to promote. The text would appear in the same color as the page background, making it invisible to the human eye but visible to search engines.
The trick was used to improve the ranking of pages in Google's search results, but the company quickly addressed the issue and today, any attempt to use SEO bombs can lead to a demotion or even a permanent ban of the website from Google.
According to Sucuri researcher Peter Gramantik, this technique has returned in a modified version, aimed not at improving SEO this time, but at helping spam emails slip through spam detection filters. The same practice can also be used on spam websites to make them undetectable.
The trick is based on inserting spaces between the letters of words and then inserting random characters in the same color as the background, so that they are not visible to the human eye. For example, the word “MONE Y” will appear to users with large gaps between the letters (“M О N Э Я”), but in the source code of the page, the text will actually be “ Мx Оi N5 Эp Юu”. Search engines, crawlers, spam filters, and spam detection engines will see this specific word and ignore it.
