HaxorSEO/HxSEO backlink marketplace for SEO poisoning
Threat Actor Meta
Summary
Hide ▲
Show ▼
The HaxorSEO/HxSEO operation is monetizing compromised-domain backlinks to push malicious pages higher in search results, increasing the reach of phishing and malware delivery. The service turns search ranking manipulation into a repeatable criminal offering across Telegram and WhatsApp.
Related Happenings
NSO Group WhatsApp spear-phishing campaign
Campaign
H score37
First: 08.06.2026 20:08
Last: 08.06.2026 20:08
Sources 1
About this happening:
NSO Group remains tied to a WhatsApp spear-phishing campaign that used malicious links to push targets to external websites outside the app. On June 8, WhatsAp...
NSO Group WhatsApp spear-phishing campaign
CampaignAbout this happening: NSO Group remains tied to a WhatsApp spear-phishing campaign that used malicious links to push targets to external websites outside the app. On June 8, WhatsAp...
Vercel v0.dev phishing campaign using GenAI-built lure pages
Campaign
H score29
First: 07.05.2026 11:30
Last: 07.05.2026 11:30
Sources 1
About this happening:
A campaign using Vercel v0.dev to build highly convincing phishing pages has lowered the skill and cost needed to run fraudulent sign-in and job-lure attacks. The activity...
Vercel v0.dev phishing campaign using GenAI-built lure pages
CampaignAbout this happening: A campaign using Vercel v0.dev to build highly convincing phishing pages has lowered the skill and cost needed to run fraudulent sign-in and job-lure attacks. The activity...
Google sponsored search ManageWP phishing campaign
Campaign
H score13
First: 07.05.2026 00:36
Last: 07.05.2026 00:36
Sources 1
About this happening:
A phishing campaign is abusing Google sponsored search results to impersonate ManageWP and steal login credentials, 2FA codes, and account access. The operation ma...
Google sponsored search ManageWP phishing campaign
CampaignAbout this happening: A phishing campaign is abusing Google sponsored search results to impersonate ManageWP and steal login credentials, 2FA codes, and account access. The operation ma...
WhatsApp anti-scam protections now warn on fraudulent device-linking requests
Security Tool/Service
H score14
First: 26.03.2026 16:06
Last: 26.03.2026 16:06
Sources 1
About this happening:
WhatsApp rolled out anti-scam protections that warn users when device-linking requests look suspicious, adding a new user-facing control against fraudulent account-l...
WhatsApp anti-scam protections now warn on fraudulent device-linking requests
Security Tool/ServiceAbout this happening: WhatsApp rolled out anti-scam protections that warn users when device-linking requests look suspicious, adding a new user-facing control against fraudulent account-l...
Meta rolls out anti-scam tools for WhatsApp, Facebook, and Messenger
Security Tool/Service
H score43
First: 12.03.2026 15:17
Last: 12.03.2026 15:17
Sources 1
About this happening:
Meta introduced new anti-scam protections across WhatsApp, Facebook, and Messenger, adding warnings and detection features to reduce scam abuse against users. The...
Meta rolls out anti-scam tools for WhatsApp, Facebook, and Messenger
Security Tool/ServiceAbout this happening: Meta introduced new anti-scam protections across WhatsApp, Facebook, and Messenger, adding warnings and detection features to reduce scam abuse against users. The...
Timeline
-
26.01.2026 17:00 2 articles · 5mo ago
HaxorSEO/HxSEO backlink marketplace discovered
Initial DisclosureThe HaxorSEO/HxSEO marketplace operates on Telegram and WhatsApp and sells a Google Sheet of more than 1000 backlinks to pre-compromised legitimate domains. The service markets older domains with trust metrics such as PA, DA, DR and spam score, and uses webshell-backed insertion of backlinks into compromised sites to raise search rankings for malicious phishing pages, including fraudulent banking login pages, while also undermining lookalike legitimate pages.
Show sources
- Researchers Uncover “Haxor” SEO Poisoning Marketplace — www.infosecurity-magazine.com — 26.01.2026 17:00
- Researchers Uncover “Haxor” SEO Poisoning Marketplace — www.infosecurity-magazine.com — 26.01.2026 17:00