BengalSEO SEO Poisoning Delivers MayaBot and Tech Scams

Cybersecurity researchers from the DFIR Report have detailed a large search engine optimization (SEO) poisoning operation, tracked as BengalSEO, that abuses Microsoft Bing results to push a custom malware called MayaBot and to send victims into tech support scams. SEO poisoning means attackers manipulate the way search engines rank pages so that malicious links appear near the top of results for ordinary searches. The DFIR Report says it discovered the campaign in March 2026 and that the activity has operated out of the Indian state of Rajasthan since at least 2015. Two IT service providers, WeConnect Solutions LLC, formerly iConnect Soft Solutions LLC, and Garage2Global, are named as driving the operation. Although Garage2Global presents itself as a website design, SEO and digital marketing company, the researchers say they found evidence that the company builds malicious web infrastructure used in the BengalSEO scam cluster.

The operation relies on black hat SEO methods such as backlinks, DOM injection, DOM shuffling and keyword stuffing. Backlinks are links from other websites, and the group creates them at scale by flooding forums and comment sections with user-generated spam that points to lure pages. DOM injection and DOM shuffling manipulate the Document Object Model (DOM), the structured set of elements that make up a page. DOM shuffling uses embedded JavaScript to randomly reorder the HTML elements, allowing identical setup guides across hundreds of domains to look unique to search engine crawlers and slip past spam filters. One example cited in the report is a Vizio smart TV setup page that has 2,000 backlinks and 167 unique external domains linking to it. The lure pages impersonate technical support and service activation portals for streaming services, and they advertise downloads for antivirus tools, gaming software, taxation utilities and activation of credit, healthcare and gift cards. In one example, a search for bitdefender central how to login leads to a fraudulent page on readthedocs[.]io with a prominent Get Started button that begins the infection chain.

Before a victim reaches the final page, the traffic passes through a traffic distribution system (TDS), a chain of redirector domains that acts as a filter and gatekeeper. Those redirects can show a Cloudflare Turnstile or hCaptcha challenge, a check designed to separate real people from automated scanners, crawlers and bots. The lure and landing pages also embed a Matomo tracking script, an analytics service, to fingerprint the browser and send information about the visitor to the domain stats.us3[.]org. A search for that domain on urlscan.io returns 1,112 results at the time of writing, down from 1,190 during the analysis. On lure pages hosted on platforms such as github.io and pages.dev, the group also uses Google Tag Manager for analytics. At the end of the redirector chain, the final landing page offers a download link and instructions for fake software. When a user clicks the Download for Windows button, they receive a ZIP archive and are then redirected to the legitimate software page after 40 seconds. Domains observed delivering payloads include ustechnio[.]com, tax.dll[.]lat, u320[.]my, reficon[.]pro, ñ[.]link and pltechoo[.]pro. Inside the ZIP file is a JavaScript dropper for MayaBot that pretends to be the program the victim wanted; when run, it executes through wscript.exe and starts the infection. MayaBot has been used by BengalSEO since 2022 to provide command-and-control (C2), a private channel for sending instructions to infected computers, monitor the system and install an XMRig cryptocurrency miner. In some cases, no payload is served: the victim instead lands on a contact page that tells them to call a scam phone number about suspicious activity linked to their Bitdefender Central account.

The group abuses the trust of legitimate hosting platforms, including github.io, pages.dev, sites.google.com and readthedocs.io, because these services carry reputation that search engines weigh favourably. The DFIR Report identified 84 active BengalSEO GitHub accounts between January 2024 and March 2026. Looking at the commit history, which records every change made to a project, researchers found email addresses tied to Garage2Global domains such as wc[.]ci. A sample includes activate-uhc-com-ucard linked to archi.jaing.2g@gmail.com, activate-uhc-helpbook linked to kamre@wc.ci, capitalonecredit linked to gracyurvashi36g2g@gmail.com, help-line-center linked to janvig2g@gmail.com and snehajaing2g linked to snehajaing2g@gmail.com. The lure pages are constantly updated through commits to rotate redirector domains or temporarily replace them with legitimate URLs, so blocked or taken-down domains can be swapped without rebuilding the pages. Most of the BengalSEO infrastructure was registered around August 2025 and later, with increased activity through late 2025 and early 2026. Domains were registered under .my, .shop and .info top-level domains. Between 2023 and 2026, Spaceship accounted for 47.6 percent of registrations and Namecheap for 28.6 percent, while Cloudflare handled 81.1 percent of hosting as a traffic proxy and Hostmaza was the origin host for 10.0 percent of domains. One account managing redirector domains including wapp[.]live was suspended by Hostmaza earlier this year.

In a related disclosure, Check Point Research described a separate ongoing campaign that has targeted Brazilian government and educational institutions since mid-2025 to turn their websites into tools for SEO manipulation. That activity is attributed to a Chinese-speaking cybercrime cluster called Gambling Goblin, which has ties to Earth Berberoka, also known as GamblingPuppet, a group known for attacking gambling websites across Asia since at least 2020. Check Point said the group operates localized phishing networks in Portuguese, Vietnamese, Spanish and English and maintains infrastructure that generates new domains daily, suggesting a model built for global scale rather than a regional experiment. The attackers install malicious Apache modules on victim servers that reverse-proxy visitors to attacker-controlled phishing pages, meaning the traffic still appears to come from the legitimate domain. The site's own Content-Security-Policy (CSP) headers, which tell browsers what content may load, are removed so injected pages can run without being blocked. Once inside, the attackers deploy a Linux toolkit that includes a custom downloader written in the Go programming language called DownPro, several backdoors, secret remote-access tools, named AlphaAgent, ChUser and oRAT for remote control, a password stealer based on 3snake, an SSH brute-forcer that repeatedly guesses passwords to gain access, and a plugin-driven reconnaissance agent. The exact initial access route is unknown. The phishing pages impersonate app stores such as Google Play, Microsoft Store and Amazon, using those high-reputation names to inflate s