Key takeaway: Google search rankings showed pronounced volatility on October 20 and 21, according to several SEO monitoring platforms, while SC Media repo.
Key Takeaway
Google search rankings showed pronounced volatility on October 20 and 21, according to several SEO monitoring platforms, while SC Media reported malicious Google Ads distributing weaponized PuTTY installers. These are separate search-related risks. The first concerns unstable SEO visibility and traffic; the second concerns the security danger of trusting sponsored download results.
What the Google ranking volatility means for SEO visibility
SEMrush, Mozcast, Algoroo, and Sistrix all reported sharp movement across multiple sectors. The volatility followed Google’s September 2026 spam update, which ran from September 24 through October 8 and targeted low-quality and spammy content. Google had not officially announced a new algorithm modification explaining the October 20–21 changes.
The reported effects were not uniform. Some website operators said Google Search and Discover traffic fell sharply on October 20. Others saw higher rankings but substantially fewer clicks. Reports also described an increase in low-quality spam appearing in Google News and Discover feeds. SEO consultant Glenn Gabe observed that two sensitive websites temporarily disappeared from Google results, including brand-specific queries, before returning by October 16. He also noted that services such as Ahrefs and Semrush did not show the changes at exactly the same time.
For SEO teams, the practical task is to compare rankings with organic clicks, Discover traffic, and branded-query visibility rather than treating a single ranking reading as a complete performance signal. The available reporting supports short-term instability, not a confirmed explanation for its cause.
How malicious Google Ads turn search visibility into download risk
SC Media, citing Smarter MSP, reported that threat actors used malicious Google Search advertisements to promote fake PuTTY download pages. The campaign used search engine optimization poisoning to place deceptive sponsored links near the top of results and targeted IT administrators looking for the software.
Users who followed the links were directed to sites hosting trojanized installers. Once executed, the malicious software could steal SSH keys and authentication tokens and give attackers remote access to the victim’s workstation. Because IT administrators may hold elevated privileges, one compromised device could enable lateral movement, privilege escalation, ransomware deployment, or persistent backdoors.
The security guidance in the report includes restricting software download sources, using ad-blocking technology, enforcing multifactor authentication for administrative accounts, verifying digital signatures before installation, and training staff to recognize search-based malware delivery. This event should not be presented as an explanation for Google’s ranking volatility. The two reports describe distinct developments that share a search entry point.
Method and Limitations
Teams can check the October 20–21 event by comparing ranking, organic-click, Discover, and branded-query data with more than one monitoring service. For software searches, they can inspect the destination domain, validate the installer’s digital signature, and use trusted download channels instead of relying solely on a sponsored result. Administrative accounts should also be reviewed for multifactor authentication, exposed SSH keys, and authentication-token activity where appropriate.
The public reports do not establish that a new Google algorithm update caused the ranking movement. They also do not state the malicious advertising campaign’s full duration, number of affected organizations, or overall scale. Timing differences between analytics platforms mean that a single tool or one day of data cannot establish a long-term SEO trend.