BengalSEO Campaign Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams

Cybersecurity researchers from the DFIR Report have disclosed details of a sprawling search engine optimization (SEO) poisoning campaign that paves the way for malware deployment and tech support scams. The campaign, codenamed BengalSEO, has been operating out of the Indian state of Rajasthan since at least 2015 and is driven by two IT service providers named WeConnect.

According to the report, the attackers manipulate Bing search results to elevate malicious websites in organic search rankings. These compromised or malicious sites are designed to deliver MayaBot malware and execute tech support scams against users. The operation leverages SEO techniques to ensure that when users search for popular topics or legitimate services, malicious sites appear prominently in the results.

The DFIR Report's disclosure in March 2026 brought attention to the campaign's longevity and scope. While the exact number of victims is not specified in the available reporting, the potential impact includes malware infection and victimization through tech support scams. The attackers' reliance on manipulating search engine rankings rather than exploiting a specific software vulnerability means the mitigation focus is on user caution and search engine security measures.