Google has started routing some search-result links through an encoded redirect instead of pointing straight at the destination site, according to a report from Malwarebytes shared with Cyber Security News. In practice, that means hovering over a result to preview where it leads a habit security-conscious users rely on to catch suspicious links before clicking often no longer shows the real destination.

What's a "goto" redirect? Instead of a search result linking directly to example.com, some results now point to an address like google.com/goto?url=<encoded text>. Your browser sends you to that Google address first, which then forwards you on to the real site. The problem is that the encoded text isn't a readable web address, so glancing at the link preview in your browser's status bar no longer tells you where you're actually about to end up.

Why This Matters for Spotting Scams

Checking a link's real destination before clicking has long been one of the simplest ways to catch a scam a misspelled domain, an unrelated host, or a suspicious file path is often visible in a browser's hover preview well before a page ever loads. Malwarebytes' report notes that with these redirects in place, the destination is only visible in the technical response Google's server sends back, something an ordinary browser doesn't surface to the person clicking.

That loss of visibility lands hardest on exactly the kind of search results attackers already target: sponsored ads, software download pages, and sign-in or account-recovery links. Malicious ads and search-result poisoning campaigns routinely buy or hijack ad placements to push people toward cloned login pages or fake installers, and a result that looks like a familiar brand name is no longer independently confirmed by what the link preview shows.

Why Google Might Be Doing This

Google hasn't given a specific reason for the change. Its broader public position is that it applies technical measures to fight abuse of its search results over time. One likely side effect, according to the report, is that the redirects make it harder for automated tools to bulk-extract where search results actually point, since each link now needs to be resolved individually rather than read directly off the page. That same friction affects legitimate tools too rank trackers, accessibility checkers, archiving services, and research tools that rely on reading search result destinations in bulk.

This isn't a confirmed attack, just reduced visibility: A goto redirect on its own doesn't mean a result is malicious, and this isn't a new malware campaign. It does mean one of the standard ways people check a link before clicking it is less reliable than before, particularly for sponsored results and anything asking for credentials, payment details, or a download.

How to Stay Safer

For anything sensitive software downloads, sign-in pages, banking, or technical support it's worth skipping the search result entirely and typing the site's known address directly, using a saved bookmark, or navigating from a company's verified profile instead. If a page you reached through search asks for login credentials, payment information, a browser extension install, or a command to paste into a terminal, treat that as a reason to stop and verify through a separate, trusted route before continuing.

Sources

  • Cyber Security News, "Google's New Search Redirects Make It Harder to Check Where Links Lead Before Clicking," September 15, 2026: cybersecuritynews.com
  • Malwarebytes, "Google's new search redirects make links harder to check before you click": malwarebytes.com

This article was written by DigitalEscapeTools based on Cyber Security News' reporting and publicly available information at the time of publication.