Search engine phishing
Search engine phishing uses deceptive websites reached through search results or search advertisements to trick people into disclosing information or taking another action for an attacker.
You can find the lure yourself
There may be no unsolicited email. You search for a service, software package, or answer, and a result leads to a page that pretends to provide it. The page may ask for account details, payment, or a download.
The FBI has documented criminals buying search advertisements that impersonate brands. A prominent position does not establish that the destination belongs to the organization you intended to reach.
Paid ads and poisoned results are different routes
Malvertising uses advertising to deliver malicious content or send people to a malicious destination. Search advertisements are one possible placement.
SEO poisoning manipulates search visibility so malicious pages appear in ordinary results. Microsoft Research’s deSEO study examined this mechanism in malware campaigns. Buying an advertisement is not, by itself, SEO poisoning.
Both routes can lead to a phishing page, but neither always does. A poisoned result might instead deliver malware. “Search engine phishing” describes the deceptive interaction reached through search; the result’s placement and the site’s next request explain the mechanism more precisely.
For a known service, use an established bookmark or type its known address. For software, check the publisher and use your organization’s approved source. If you reached a suspicious site, report the destination and what you did there. A visit, a download, and running a file are different events.
The search-ad article follows those events through a reported campaign. If the site offers to convert a work document, the issue may instead be what you are about to upload; the file-converter article covers that decision.