Hackers Found a Way to Quietly Boost Illegal Gambling Sites on Google

Cybersecurity company ESET has reported the emergence of a new hacking group called GhostRedirector, which has developed an unusual method for promoting illegal gambling websites via Google Search.

How the Scheme Worked

The attackers compromised legitimate websites and installed special scripts on them. These scripts were designed in such a way that regular users would see the normal, unaltered version of the website, while Google’s search crawler, Googlebot, was shown fake content.

To Googlebot, the hacked pages contained hundreds of hidden backlinks to illegal gambling platforms. Google interpreted this as a sign of credibility and began ranking those shady sites higher in search results.

What it Means

As a result, users were more likely to click on those sites, trusting Google’s ranking, without realizing they were being directed to unlicensed platforms. At the same time, the owners of the hacked websites often had no idea they were compromised, since everything looked normal from a user’s perspective. However, their reputation was at risk, as Google could penalize them for artificial link manipulation.

The key novelty of this method lies in the server-level deception. Unlike traditional black-hat SEO techniques, this attack targeted IIS server software, manipulating how content is served to Googlebot specifically.

This made the attack particularly stealthy. Site administrators could go weeks or even months without detecting any issues, as their websites continued to function normally for visitors. Only Googlebot was shown the manipulated content.

While SEO manipulation techniques have existed for years, using compromised servers to spoof content exclusively for search engine crawlers is a new and dangerous development.

Expert Recommendations

ESET advises website owners to closely monitor their server infrastructure, promptly patch vulnerabilities, and regularly update their software to avoid becoming part of such schemes.