In July, an IT administrator searched for a common network tool, clicked the top result, and installed it. The file was digitally signed. It even installed the real program alongside itself. About 44 hours later, ransomware had encrypted the entire company.

Nothing about that search looked wrong. That is the point.

The tool was ManageEngine OpManager, the kind of program IT teams use every day. The top result was not the vendor. It was a lookalike the attackers had pushed to the top of the results, a trick known as SEO poisoning. The download carried ransomware from a group called Akira, tucked in beside the genuine software, so nothing seemed off until systems started going dark. Security researchers at The DFIR Report traced the whole chain this June.

Here is why it should worry you. The trap was built for the person you trust most, your IT staff, because their access turns a single download into a company-wide outage. It skips email completely, so your filters and your phishing training never get a vote. And it is not rare. Akira alone has hit more than 1,400 organizations and taken in at least $244 million since 2023, according to the FBI and CISA, and a poisoned search result is one of its two main ways in.

The fix is a habit, and it costs almost nothing. When your people need software, they go to the vendor's own site, the address they already know, not the top of a search and not an ad. Better yet, decide in advance what is even allowed to install. Make the safe way the easy way, because people take the easy way.

The most dangerous download is the one that looks exactly like the one you wanted.

NexusTek is a CMMC L2-certified managed service provider serving small and mid-sized businesses across the United States.