How Phishing Exploits Search: SEO Poisoning and Cloaking
It sounds like an exaggeration. It isn’t. A brand search feels safe precisely because the results almost never change — and that stability is exactly what an attacker exploits. In this article I’ll walk through, step by step, how a phishing site plants itself inside the search results of an established brand. Not from theory, but from what I’ve observed on the defensive side for some time. Why…
Phishing attacks exploit search engine optimization (SEO) techniques to infiltrate the search results of well-known brands. Attackers create a pixel-perfect clone of the brand's website and register a domain that evokes the brand's name to avoid detection. They then use a cloaking layer, or shell, to serve only the targeted profile, redirecting everyone else to the genuine site.
To reach potential victims, attackers build a separate landing page with a domain similar to the brand and insert it into the canonical tag of a compromised site purchased on the black market. This process, known as site reputation abuse, leverages the trust associated with established, trusted sites to transfer trust to the phishing page. Bulk backlinks are added to the compromised site to further boost its ranking for the brand term, making it appear on the fourth or fifth page of search results.
To increase the likelihood of a click, attackers use fake engagement—automated click farming—where sessions imitate real users clicking on the phishing link. Once a user clicks the link, the cloaker routes them to the clone based on their profile, and they enter their credentials, believing they are logging into the legitimate site.
While the phishing site may only last a few days before being caught by search algorithms, this short window can result in significant financial losses. In 2025, phishing and spoofing were the most reported crime types, with losses surpassing $20 billion according to the FBI's Internet Crime Complaint Center Annual Report. To protect against such attacks, a search-forensics early-warning system can be implemented.
This involves continuous SERP monitoring of brand terms, tracking the position of the site, and raising an alarm when anomalies are detected. The system can then automatically inspect the suspect site for signs of cloaking and take appropriate action.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
