BengalSEO Poisons Bing to Deliver Malware and Tech Support Scams Since 2015

The BengalSEO cybercrime group, operating from Rajasthan, India since at least 2015, systematically manipulates Bing search results to distribute the custom MayaBot malware and drive tech support scams. The findings, documented by The DFIR Report in March 2026 and reported by The Hacker News, expose an ecosystem of two formally registered IT providers that convert legitimate expertise in SEO, web development, and digital marketing into malicious infrastructure. The campaign abuses high-reputation platforms — GitHub, Cloudflare, Google Sites, ReadTheDocs — rendering the line between legitimate hosting and structured abuse invisible.

How BengalSEO's SEO Poisoning Works

The technique unfolds in three stages: index poisoning, selective traffic filtering, and a final fork between malware or scam. Lure pages impersonate tech support portals, streaming activation sites, antivirus downloads, gaming software, tax utilities, and card activation pages. A documented example: the query "bitdefender central how to login" redirects to readthedocs[.]io, where a "Get Started" button triggers the infection chain.

Ranking on Bing is achieved through aggressive manipulation of trust signals. The DFIR Report cites "backlinks, DOM injection, DOM shuffling, and keyword stuffing" as standard techniques. DOM shuffling — dynamic reordering of HTML elements via JavaScript — randomizes the Document Object Model structure to appear unique to crawlers, evading deduplication filters. A single Vizio lure page amassed 2,000 backlinks from 167 unique external domains. The group generates this link mass through aggressive spam of user-generated content, according to the DFIR Report citation carried by The Hacker News.

The traffic distribution system forms the second ring. Matomo tracks the victim's browser and sends data to stats.us3[.]org, with 1,112 documented results on urlscan.io at the time of writing. The TDS employs Cloudflare Turnstile or hCaptcha as a challenge-response to exclude automated scanners before exposing the payload. The final fork is binary: in one branch, a ZIP archive containing a JavaScript dropper for MayaBot masquerades as an executable and is launched via wscript.exe; in the other, no payload is served and the victim is redirected to a page with a phone number for a tech support scam. The Hacker News documents a 40-second delay before redirecting to a legitimate software page after the ZIP download, a likely tactic to reduce suspicion.

Parasitic Infrastructure on Legitimate Platforms

The operational paradox of BengalSEO lies in its reliance on technically trustworthy platforms, transformed into unwitting pillars of malicious infrastructure. Repositories on GitHub, sites on Google Sites, pages on Cloudflare Pages, and documentation on ReadTheDocs are not technically compromised: they are abused through legitimate accounts, with content that exploits the parent domain's reputation to bypass allowlist-based filters.

The DFIR Report identified 84 active GitHub accounts between January 2024 and March 2026. Commit history reveals emails with domains associated with Garage2Global, notably the "wc[.]ci" pattern and the recurring "2g" or "g2g" — a likely abbreviation for Garage2Global. Documented examples: the account "activate-uhc-com-ucard" with email archi.jaing.2g@gmail.com, and "capitalonecredit" with gracyurvashi36g2g@gmail.com. The Hacker News reports that "Matomo was not the only analytics system used by BengalSEO, lure pages on hosting platforms such as github.io and pages.dev instead typically use analytics services such as Google Tag Manager."

Domain registration shows concentration on specific registrars: between 2023 and 2026, Spaceship accounted for 47.6% of registrations and Namecheap for 28.6%. For hosting, Cloudflare dominates with 81.1% of domains using it as a traffic proxy, while Hostmaza serves as the origin host for 10.0%. The bulk of infrastructure was registered from August 2025 onward, with a peak of activity between late 2025 and early 2026. A Hostmaza account for the domain wapp[.]live was suspended in early 2026, but operational continuity suggests infrastructural redundancy.

From IT Provider to Criminal Operator: Garage2Global's Double Face

The most destabilizing element for the industry's trust model is the overlap between legitimate commercial identity and malicious activity. Garage2Global publicly advertises web design, SEO, and digital marketing services. The DFIR Report, cited by The Hacker News, "unearthed evidence indicating the company develops malicious web infrastructure used in SEO poisoning campaigns." WeConnect Solutions LLC, formerly known as iConnect Soft Solutions LLC, appears as the second actor, but the dossier does not break down the exact role of each in the operational chain. It is unclear whether both entities are aware of the dual activity, or if one serves as an unwitting front for the other.

This ambiguity renders traditional due diligence checks based on corporate registration and online presence ineffective. A company with real clients, a public portfolio, and active social profiles can simultaneously fuel a decade-plus criminal operation, leveraging the same technical expertise — search engine optimization, web development, automation — in both domains.

"This group utilizes its extensive SEO and web development capabilities to create and promote lure pages with multiple Black Hat SEO techniques" — DFIR Report, cited by The Hacker News

What to Do Now

For users, a tech support query on Bing demands cross-verification: a readthedocs[.]io or github[.]io domain in a search result for "bitdefender central how to login" is an indicator of anomaly, not reliability. The "Get Started" button on seemingly official documentation can trigger a ZIP download with a JavaScript dropper for MayaBot.

For threat intelligence teams, the DFIR Report documented 84 active GitHub accounts with "2g"/"g2g" email patterns and "wc[.]ci" domains — indicators of association with Garage2Global. The presence of Matomo tracking to stats.us3[.]org, with 1,112 results on urlscan.io, and the use of Cloudflare Turnstile or hCaptcha as a pre-payload filter are signals of an active TDS.

For hosting platforms, the concentration of 47.6% of registrations on Spaceship and 28.6% on Namecheap between 2023 and 2026, with 81.1% of domains using Cloudflare as a proxy, provides a recurring registration profile. The bulk from August 2025 onward and the peak in late 2025/early 2026 indicate a measurable infrastructure expansion window.

For search engines, DOM shuffling — dynamic HTML reordering via JavaScript — and aggressive UGC spam generating 2,000 backlinks per single lure page represent evasion techniques detectable through structural coherence analysis and anomalous link acquisition velocity.

Questions and Answers

Why is Bing vulnerable to this type of attack?

The campaign exploits Bing's reliance on trust signals such as backlinks and hosting on high-reputation domains, not a technical vulnerability in the engine. The manipulation occurs at the algorithmic level, not via exploit.

Is MayaBot ransomware?

No. According to the DFIR Report, MayaBot is a custom malware for command-and-control, system monitoring, and delivery of the XMRig miner. No data encryption functionality is documented.

Have the legitimate platforms been compromised?

No. GitHub, Cloudflare, Google Sites, and ReadTheDocs are abused as consensual hosting, not technically breached. The malicious content exploits the parent domain's reputation without requiring a breach.

Sources

• https://thehackernews.com/2026/09/bengalseo-poisons-bing-search-results.html
• https://thomasharris6.wordpress.com/2026/09/08/bengalseo-poisons-bing-search-results-to-deliver-mayabot-and-tech-support-scams/
• https://news.cybertechworld.co.in/index.php/2026/09/08/bengalseo-poisons-bing-search-results-to-deliver-mayabot-and-tech-support-scams/
• https://www.guardianmssp.com/2026/09/08/bengalseo-poisons-bing-search-results-to-deliver-mayabot-and-tech-support-scams/