BengalSEO Poisons Bing Search Results to Deliver Maya Bot and Tech Support Scams
Summary: The DFIR Report disclosed in March 2026 a campaign it named BengalSEO, run out of Rajasthan, India since at least 2015 by two IT service providers, WeConnect Solutions LLC and Garage2Global, that uses black hat SEO techniques to push lure pages to the top of Microsoft Bing results. The pages impersonate tech support and service activation portals and feed a traffic distribution system that fingerprints browsers, uses Matomo for tracking, and delivers either the MayaBot malware - which provides command-and-control and drops an XMRig cryptocurrency miner - or a tech support scam phone number.
Why it matters: The operation ran for roughly a decade and, between January 2024 and March 2026, used as many as 84 active GitHub accounts hosted on trusted platforms like github.io and readthedocs.io, with the bulk of its infrastructure registered around August 2025 and later - so the reputation your users trust in search results is the delivery mechanism.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026