HaxorSEO/HxSEO backlink marketplace for SEO poisoning
Threat Actor Meta
Summary
Hide ▲
Show ▼
The HaxorSEO/HxSEO operation is monetizing compromised-domain backlinks to push malicious pages higher in search results, increasing the reach of phishing and malware delivery. The service turns search ranking manipulation into a repeatable criminal offering across Telegram and WhatsApp.
Related Happenings
Vercel v0.dev phishing campaign using GenAI-built lure pages
Campaign
First: 07.05.2026 11:30
Last: 07.05.2026 11:30
Sources 1
About this happening:
A campaign using **Vercel v0.dev** to build **highly convincing phishing pages** has lowered the skill and cost needed to run fraudulent sign-in and job-lure attacks. The activity...
Vercel v0.dev phishing campaign using GenAI-built lure pages
CampaignAbout this happening: A campaign using **Vercel v0.dev** to build **highly convincing phishing pages** has lowered the skill and cost needed to run fraudulent sign-in and job-lure attacks. The activity...
Google sponsored search ManageWP phishing campaign
Campaign
First: 07.05.2026 00:36
Last: 07.05.2026 00:36
Sources 1
About this happening:
A **phishing campaign** is abusing **Google sponsored search results** to impersonate **ManageWP** and steal login credentials, **2FA codes**, and account access. The operation ma...
Google sponsored search ManageWP phishing campaign
CampaignAbout this happening: A **phishing campaign** is abusing **Google sponsored search results** to impersonate **ManageWP** and steal login credentials, **2FA codes**, and account access. The operation ma...
WhatsApp anti-scam protections now warn on fraudulent device-linking requests
Security Tool/Service
First: 26.03.2026 16:06
Last: 26.03.2026 16:06
Sources 1
About this happening:
**WhatsApp** rolled out **anti-scam protections** that warn users when **device-linking requests** look suspicious, adding a new user-facing control against **fraudulent account-l...
WhatsApp anti-scam protections now warn on fraudulent device-linking requests
Security Tool/ServiceAbout this happening: **WhatsApp** rolled out **anti-scam protections** that warn users when **device-linking requests** look suspicious, adding a new user-facing control against **fraudulent account-l...
Meta rolls out anti-scam tools for WhatsApp, Facebook, and Messenger
Security Tool/Service
First: 12.03.2026 15:17
Last: 12.03.2026 15:17
Sources 1
About this happening:
Meta introduced **new anti-scam protections** across **WhatsApp**, **Facebook**, and **Messenger**, adding warnings and detection features to reduce scam abuse against users. The...
Meta rolls out anti-scam tools for WhatsApp, Facebook, and Messenger
Security Tool/ServiceAbout this happening: Meta introduced **new anti-scam protections** across **WhatsApp**, **Facebook**, and **Messenger**, adding warnings and detection features to reduce scam abuse against users. The...
Compromised legitimate WordPress websites used to infect visitors with infostealer malware campaign expands across multiple victims
Campaign
First: 11.03.2026 16:45
Last: 11.03.2026 16:45
Sources 1
About this happening:
A **global ClickFix campaign** is abusing compromised **WordPress** sites to push **infostealer malware** to visitors, putting credentials and financial data at risk. The operatio...
Compromised legitimate WordPress websites used to infect visitors with infostealer malware campaign expands across multiple victims
CampaignAbout this happening: A **global ClickFix campaign** is abusing compromised **WordPress** sites to push **infostealer malware** to visitors, putting credentials and financial data at risk. The operatio...
Timeline
-
26.01.2026 17:00 2 articles · 4mo ago
HaxorSEO/HxSEO backlink marketplace discovered
Initial DisclosureThe HaxorSEO/HxSEO marketplace operates on Telegram and WhatsApp and sells a Google Sheet of more than 1000 backlinks to pre-compromised legitimate domains. The service markets older domains with trust metrics such as PA, DA, DR and spam score, and uses webshell-backed insertion of backlinks into compromised sites to raise search rankings for malicious phishing pages, including fraudulent banking login pages, while also undermining lookalike legitimate pages.
Show sources
- Researchers Uncover “Haxor” SEO Poisoning Marketplace — www.infosecurity-magazine.com — 26.01.2026 17:00
- Researchers Uncover “Haxor” SEO Poisoning Marketplace — www.infosecurity-magazine.com — 26.01.2026 17:00