Threat actors are abusing Google’s Looker Studio (formerly Google Data Studio) to boost search engine rankings for their illicit websites that promote spam, torrents, and pirated content.
The SEO poisoning attack uses Google’s datastudio.google.com subdomain to lend credibility to malicious domains.
Abusing Data Studio to boost warez sites’ rankings
Researchers from BleepingComputer have come across several pages of Google search results flooded with datastudio.google.com links after a concerned reader reported seeing the erratic behavior to us.
These links, rather than representing a legitimate Google Data Studio project, are minisites that host links to pirated content.
For example, one search result that was clicked on directs users looking to “Download Terrifier 2 (2022)” to bit.ly links that further redirect multiple times to ultimately land on a spammy website.
As evident from the screenshot below, the SEO poisoning campaign uses the keyword stuffing technique, which is often considered a form of webspam, to boost rankings of these illicit domains:
Clicking on one of these Bit.ly URLs further redirects the user several times before they arrive on a website promoting online surveys, streaming sites of dubious legality and authenticity, and spam:
Introduced in 2016 by Google, Looker Studio (formerly Google Data Studio) is a web-based business intelligence tool that enables users to transform data into customizable informative reports and dashboards for easy visualization and analysis.
Data Studio can be and has been used to track and visualize open-source packages’ download counts for a given period.
While the legitimate business use cases of Looker Studio are plenty, much like any other web service, it isn’t immune from being abused by threat actors looking to host questionable content or manipulating SEO for their illicit domains.
SEO poisoning campaigns spotted in the past have targeted U.S. midterm election keywords and have more recently been seen pushing malware-laced Zoom, TeamViewer, and Visual Studio installers.