SEO poisoning is being applied primarily to results related to VPN app downloads. However, the first results actually lead to the download of VPNs trojanized with the “Playfulghost” malware.

Playfulghost is a particularly dangerous strain of malware that enables attackers to remotely execute a range of activities once the device is infected.