BengalSEO Campaign Uses Bing Results to Spread MayaBot
BengalSEO turns search visibility into a malware and scam channel
The DFIR Report has detailed BengalSEO, a large search engine optimisation poisoning operation that directs Microsoft Bing users to MayaBot malware downloads and technical-support scams. Discovered in March 2026, the campaign has operated from Rajasthan, India, since at least 2015 and has used the custom MayaBot malware since 2022.
Researchers linked the activity to two IT service providers, WeConnect Solutions LLC, formerly iConnect Soft Solutions LLC, and Garage2Global. The report said evidence indicates that Garage2Global develops malicious web infrastructure used by the BengalSEO scam cluster, despite presenting itself as a website design, SEO and digital marketing provider.
The operation targets searches for technical support, service activation and software downloads. Its decoy pages impersonate streaming-service support and activation portals, and advertise antivirus tools, gaming software, tax utilities, and credit, healthcare and gift-card activation. One observed lure hijacked the query “bitdefender central how to login” with a bogus readthedocs.io page featuring a prominent “Get Started” button.
Black-hat SEO feeds a controlled redirect chain
BengalSEO uses backlinks, keyword stuffing, DOM injection and DOM shuffling to elevate lure pages in Bing results. The group also posts user-generated-content spam at scale in forums and comment sections. A Vizio-themed decoy page had 2,000 backlinks from 167 unique external domains, illustrating the volume used to influence ranking systems.
DOM shuffling dynamically reorders HTML elements through embedded JavaScript. The technique allows nearly identical setup guides distributed across hundreds of domains to look distinct to crawlers and to evade spam filtering. The lure pages are hosted on services including github.io, pages.dev, sites.google.com and readthedocs.io, making use of the reputation of legitimate hosting platforms.
Visitors are routed through a traffic distribution system that manages redirection, filtering and campaign performance. Before a final payload page appears, redirectors may show Cloudflare Turnstile or hCaptcha challenges to exclude scanners, crawlers and bots. Lure and landing pages also use Matomo scripts to collect client-side browser information and send it to stats.us3[.]org; pages on some hosting services instead use Google Tag Manager.
MayaBot delivery and the operational footprint
A final landing page can offer a “Download for Windows” link, delivering a ZIP archive before redirecting the visitor to the legitimate software page after 40 seconds. The archive contains a JavaScript dropper disguised as the requested program. It runs through wscript.exe and starts the MayaBot infection chain, enabling command-and-control, system monitoring and delivery of an XMRig cryptocurrency miner.
Other final pages do not deliver a file. They send victims to a contact page that urges them to call a BengalSEO number over alleged suspicious activity in a Bitdefender Central account. The group continually updates its decoy pages through commits, rotating redirectors or temporarily substituting legitimate URLs to avoid detection and replace blocked domains.
The DFIR Report detected 84 active BengalSEO GitHub accounts from January 2024 through March 2026, with commit-history email addresses tied to Garage2Global domains. Most infrastructure was registered in or after August 2025. Between 2023 and 2026, Spaceship registered 47.6% of the group’s domains and Namecheap 28.6%, while Cloudflare proxied 81.1% of traffic and Hostmaza originated 10.0% of domains.
For businesses, the campaign shows that search ranking is not a trust signal. Security teams should steer users to verified vendor portals, scrutinise support and activation requests reached through search, and limit execution of untrusted script-based downloads on Windows endpoints.