Hackers hijack dozens State.gov websites to push AI Porn
Brazen cybercriminals are found hijacking dozens of trusted state government URLs – pushing AI-generated porn ads and other illicit content into Google search results - with many of the seedy redirects still showing up as of Friday.
-
At least 38 State.gov sites have been hijacked since November, including Nebraska, Indiana, Hawaii, California, and Washington.
-
Google search results for the sites were redirected to show ads for AI porn how-tos, sex chatbots, sex toys, rap videos, gaming cheats, and more.
-
Granicus, a third-party government web-hosting firm, says hackers uploaded the materials via municipal public messaging forms without breaching any systems.
The “Municipal AI porn” SEO poisoning attack campaign (we just made that up) apparently began late last month, impacting at least 18 state governments so far, including in Nebraska, Indiana, Hawaii, California, Washington, Ohio, Idaho, and Kansas.
The malicious webpages replacing the official websites have been seen hosting a variety of questionable content, including ads for AI porn creation, AI-generated nude images, online sex toy stores, and ads for penis enlargement.
Others have been randomly linked to rap videos from the artist “Young Boy,” video game cheats for gaming platforms like Roblox, and various other ads contain clickable malware downloads and malicious links.
“The Best PORN AI Platform in 2025 - All in One Place. Al-generated adult images & videos - ultra-realistic, fully customizable. Explicit Al chatbots & sexual roleplay - immersive 18+ conversations. Al Porn tools & advanced photo alteration - reveal or enhance images instantly. If you're searching for the best Porn Al tool, this platform combines speed, privacy, and the most realistic results available in 2025. No downloads. Instant results⚫ 100% private 18+ only.Access The Best NSFW AI Platform Now. Top NSFW Platform Al 3 Years Running”
- Dozens of government websites are redirected to AI porn ads and then indexed on Google. Text from a real advertisement.
Already making the rounds on Reddit and covered by local media outlets in the affected states, security researcher Domiminc Alvieri posted several examples of the pornographic hijacking on his X account on Friday.
“Researching a new cyber attack on one US state and I’ve found some odd PDFs, XXX videos, and rap videos on other state and local government websites, “ Alvieri wrote in one post.
Citing examples targeting “The State of Idaho (who) loves YoungBoy,” the researcher further explained that the “massive perverted free ‘porn ai tool’ PDF campaign” has impacted multiple local and state government websites.
But Alvieri also pointed out that technically, the websites themselves were not actually exploited. “They don’t appear to be hacked in any way, all PDFs appear to be just uploaded by someone,” Alvieri said.
And Alvieri is correct. It seems the Denver-based software company, Granicus, which hosts roughly 5,500 government sites, told Kansas’ local KWCH 12 News back on November 24th that it was aware of the reports but had “not seen any breach of its systems or data.”
Racy ads uploaded via .gov public inquiry forms
In an official statement sent to Cybernews on the matter, Granicus says that “outside actors” had found a way to infiltrate the government web portals by "attaching the illicit content to a public form they submitted through a government web portal intended for communicating resident feedback or service requests."
“There has been no breach of Granicus systems or products, nor exposure of any data.”
- Granicus spokesperson
“Those attachments were then indexed by Google, causing them to appear in very targeted search results,” Granicus stated.
The Granicus spokesperson reiterated that the attacks "are not specific to websites managed by any specific technology vendor, and that only a small subset (less than a handful) occurred to Granicus website customers.”
"While the above feature was intended by governments to provide transparency and good customer service, it has been abused in these instances," Granicus explained.
In other instances, the illicit material was reported to have been caused by “a surge in bot activity” or injected via "a group VA calendar," with tech teams identifying 10 separate IP addresses (now blocked) used to upload the content.
Freelance journalist and AI researcher Brian Penny from Tucson, Arizona, first discovered “an AI sex ad linked to the Nevada Department of Transportation” late last month, alerting the LA Times to the indecent switch.
Since then, Penny has “tracked 38 government agencies in 18 states and three countries that have been targeted by porn, video game, crypto currency and other advertisers,” the Times reported on December 4th.
The following is a list of just some of the government agency websites that were subjected to the triple-x uploads, gathered from various reports, with Nebraska seemingly having the most poisoned PDFs on Google so far, said Alvieri.
- California Secretary of State
- Hawaii State Government
- Indiana State Department of Health (IDOH)
- Mojave Desert Air Quality Management District (MDAQMD)
- Nevada Department of Transportation (NDOT)
- Tahoe Regional Planning Agency (TRPA)
- New York State Museum (NYSM)
- Washington State Department of Fish and Wildlife (WDFW)
- Washington State Department of Veterans Affairs (VA)
- Washington State Fire Commissioners Association (WFCA)
- US General Services Administration (GSA)
“Granicus takes this abuse very seriously and immediately implemented a block on our security platform to ensure that uploaded documents can no longer be publicly accessible,” the company said.
