400,000 search queries on Google Video lead to poisoned results and may lead users to download malicious software. That’s according to a Trend Micro blog post this weekend reported today by The Register.

Trend Micro believes this “blackhat SEO poisoning” comes from a group that maintains multiple domains with “keyword-riddled pages” that often appear on top of the search results. When users click through to one of these domains, the problems begin:

“… instead of legitimate videos researchers found some 400,000 queries returning video results that have a single redirection point, and one that eventually leads to malware download and execution.

Trend Micro detects the malicious executable as WORM_AQPLAY.A. This worm – file name FlashPlayer.v3.181.exe and from that alone one can already guess the social engineering strategy – spreads via removable and network drives when autorun is enabled. It masquerades as an Adobe Flash installer, which users who visit certain spoofed versions of video streaming websites are prompted to download and install.”

Trend Micro says only searchers coming from Google Video to these domains are prompted to download the malicious Flash installer file.

Related Topics: Google: SEO | Google: YouTube & Video | SEO: Spamming

About The Author: Matt McGee is Search Engine Land's Executive News Editor, responsible for overseeing our daily news coverage. His news career includes time spent in TV, radio, and print journalism. His web career continues to include a small number of SEO and social media consulting clients, as well as regular speaking engagements at marketing events around the U.S. He blogs at Small Business Search Marketing and can be found on Twitter at @MattMcGee and/or on Google Plus. See more articles by Matt McGee