Cybercriminals have turned to search engine optimization (SEO) techniques in order to distribute malware, which is subsequently employed to steal sensitive user data or sell rogue software, a recent report indicates.

According to UK researchers, the criminals’ strategy has been to compromise legitimate websites by injecting SEO targeted pages which include frequently misspelled keywords or popular search keywords with minor typos, as well as keywords marked “trendy” by the Google Trends search engine. When consumers type the respective key terms into their browsers, search engines display the injected pages as top search results, redirecting legitimate consumer traffic to the compromised websites. The report also indicates that cybercriminals operate as part of professionally organized structures, which also include secondary, affiliate networks, whose members are rewarded for each successful redirection.

According to researchers from UK secure web gateway products and services company Finjan, such malware-oriented SEO technique have been extremely effective. Data recovered by the company’s analysts from one rogue server employed by criminals show that the server in question had yielded almost half a million Google searches to compromised sites. Also, the same server had successfully redirected 1.8 million unique users to a false anti-virus software website site during 16 consecutive days.