Malwarebytes researchers have discovered a campaign that abuses Google search featured snippets to display links to compromised websites, which ultimately redirect users to online scams or even exploit kits that infect them with ransomware.
In this campaign, the scammers identify websites that appear in "featured snippets," a Google feature that displays answers to frequently asked questions.
Most of the time, these links lead to safe websites like Wikipedia, but in some cases also to personal blogs or news websites.
In an active campaign detected by Malwarebytes' Jerome Segura, scammers redirected users from a featured snippet for a Hungarian website to an online store selling product keys for Microsoft Office.
If the user realized something was wrong when they clicked on one domain and ended up on another, then by entering the Hungarian website, they would actually be taken to a page hosting the Neutrino exploit kit, which in turn would infect them with the CryptMIC ransomware.
The strange thing about this infection is that the hackers even managed to trick search engine into ranking the original website, a sports-related page, as the best answer for an Office-related question, meaning Google now has two problems instead of one.
"Taking" on SEO results is nothing new, of course, but we would expect it to happen with classic search results and not with featured snippets.
In an alternative scenario, fraudsters could be looking for third-party websites that appear in featured snippets and that run vulnerable CMSs.
After hacking these websites, they could implement the same scenario as above - hijacking the site's traffic coming through Google's featured snippet.
Fraudsters do not need to change the ranking of Google search results to insert malicious featured snippets and could very easily "hunt" sites that already have this privileged position.
