Search-Spam Campaigns Exploit Public Uploads on Trusted Domains

Search-spam operators have likely used thousands of government and education domains to place deceptive material in search results. Research published by UpGuard on 8 July 2026 identified 2,167 such domains across 80 countries in copyright takedown records covering activity through 4 May 2026. UpGuard said the records provide a way to identify likely compromised sites, although they do not establish through forensic analysis that every domain was compromised.

The findings show the scale of a problem that can exploit the authority of institutional domains. UpGuard counted 646 government domains and 1,521 education domains among records involving content used for parasite search engine optimisation. The company also noted that increased detection and reporting contributed to the growth visible in the data, meaning the figures measure both attacker activity and greater visibility into it.

Cybersecurity writer Dark Marc documented a Drupal-specific example in a blog post published on 6 July 2025. The post showed movie-themed spam files on government and education websites, including public directory paths associated with Drupal Webform and WordPress form plugins. The files used fake video-player images that directed visitors to external streaming sites, but their appearance in search results did not by itself confirm how every affected website had been accessed.

For Drupal sites, the relevant exposure is an established configuration risk rather than evidence of a newly disclosed Webform vulnerability. Drupal Security Team advisory PSA-2016-003 warns that sites are at risk when anonymous or otherwise untrusted users can upload files into a public file system. Those files can then be accessed directly and indexed by search engines. The advisory says most reported cases involved Webform, while noting that other modules can expose the same configuration problem.

Drupal administrators should store untrusted uploads in the private file system, restrict upload access where appropriate, verify that cron removes temporary files, and inspect public directories for unexpected content. Unexpected indexed files should also prompt a review of access logs, form permissions, allowed file types, and upload destinations. These measures address one documented route into search-spam infrastructure without suggesting that Drupal caused the wider campaign.