BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams
DFIR Report exposes BengalSEO, an India-based SEO-poisoning operation running since 2015, delivering MayaBot malware and tech support scams via Bing results.
The DFIR Report details BengalSEO, a financially motivated cluster operating from Rajasthan, India, since at least 2015, run through two IT service providers: WeConnect Solutions LLC and Garage2Global. The group uses black-hat SEO techniques—backlinks, DOM injection, DOM shuffling, keyword stuffing—to push lure pages to the top of Microsoft Bing results, routing victims through a traffic distribution system to either the custom MayaBot malware (which delivers an XMRig cryptominer and enables C2) or tech support scam call centers. A Vizio decoy page had 2,000 backlinks from 167 unique external domains, and Matomo analytics is used for victim fingerprinting, with the tracking domain appearing in 1,112 urlscan.io results.
- Two Rajasthan IT firms build and promote malicious lure pages at scale
- MayaBot enables C2, monitoring, and XMRig miner delivery since 2022
- TDS uses Cloudflare Turnstile/hCaptcha to screen scanners and bots
- Legitimate hosting (github.io, pages.dev, readthedocs.io) abused for trust
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dll.lat | for payload delivery are listed below - ustechnio[.]com tax.dll[.]lat u320[.]my reficon[.]pro ñ[.]link pltechoo[.]pro Present w |
| domain | pltechoo.pro | echnio[.]com tax.dll[.]lat u320[.]my reficon[.]pro ñ[.]link pltechoo[.]pro Present within the ZIP file is a JavaScript dropper for M |
| domain | readthedocs.io | central how to login" to serve a fraudulent link hosted on readthedocs[.]io. The page features a prominent "Get Started" button that |
| domain | reficon.pro | are listed below - ustechnio[.]com tax.dll[.]lat u320[.]my reficon[.]pro ñ[.]link pltechoo[.]pro Present within the ZIP file is a |
| domain | u320.my | d delivery are listed below - ustechnio[.]com tax.dll[.]lat u320[.]my reficon[.]pro ñ[.]link pltechoo[.]pro Present within the |
| domain | us3.org | e client-side and send the information to the domain "stats.us3[.]org." A search for the domain "stats.us3[.]org" on urlscan.io |
| domain | ustechnio.com | of the domains used for payload delivery are listed below - ustechnio[.]com tax.dll[.]lat u320[.]my reficon[.]pro ñ[.]link pltechoo[. |
| domain | wapp.live | ins." One account managing some of the redirector domains ("wapp[.]live") was suspended by Hostmaza earlier this year. The disclo |
| domain | wc.ci | red email addresses linking them to Garage2Global domains ("wc[.]ci"). A sample of some of the GitHub accounts and their asso |
From the original article
6 min read at thehackernews.com
Cybersecurity researchers have disclosed details of a sprawling search engine optimization (SEO) poisoning campaign that paves the way for malware deployment and tech support scams. The campaign, discovered by the DFIR Report in March 2026, has been codenamed BengalSEO. It has operated out of the Indian state of Rajasthan since at least 2015, driven by two IT service providers named WeConnect
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.