BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams

Summary

Cybersecurity researchers uncovered BengalSEO, a long-running SEO poisoning operation originating from Rajasthan that manipulates search results to deliver MayaBot malware and tech support scams. The operation weaponizes reputable cloud platforms and complex traffic distribution systems.

Key Takeaways

1. The campaign, discovered by the DFIR Report in March 2026, has been codenamed BengalSEO.
2. One of the payloads is a custom malware dubbed MayaBot, which is responsible for enabling command-and-control (C2), system monitoring, and delivering an XMRig cryptocurrency miner.
3. The disclosure comes as Check Point Research shared details of a sustained campaign targeting Brazilian government and educational institutions since mid-2025 to turn their websites into a weapon for SEO manipulation.

Statement Breakdown

• Claimed Facts: 75% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The reporting relies on detailed threat intelligence from established cybersecurity research organizations, specifically The DFIR Report and Check Point Research. Technical mechanisms, infrastructure indicators, and specific attack chains are thoroughly documented. Findings are presented factually with direct technical evidence and quotes from security researchers.

Bias assessment: Technical and Security-Focused. The article maintains an objective, technical tone standard for cybersecurity threat reporting. It focuses entirely on attack techniques, campaign infrastructure, and attribution findings without emotional framing or partisan perspective. Both technical risks and investigative caveats are communicated clearly.

Note: This article cites technical findings from established cybersecurity research teams detailing ongoing malware campaigns.

Credibility flag: Verified Threat Intel

Claimed Facts (4)

• Checkable factual claim regarding the geographic origin and operating companies of the threat group.
• Verifiable statistic on attacker infrastructure accounts.
• Checkable technical implementation detail of the tracking mechanism.
• Verifiable binary and script analysis finding.

Opinions (5)

• Expert evaluation describing the threat actor's skill set and technical methodology.
• Analytical deduction by researchers regarding campaign strategy.
• Analytical interpretation of why specific hosting platforms were selected.
• Qualitative evaluation of the scope and intent of the campaign.
• Assessment of threat actor motives without absolute certainty.

Claims (5)

• Highlights a company's front-facing commercial claims that contradict forensic evidence.
• Fraudulent representations made on deceptive decoy pages.
• Deceptive promises used to trick victims into downloading malware.
• Deceptive spam lure text intended to trick users onto malicious domains.
• Fabricated security alerts used to manipulate victims into tech support scams.

Key Sources

• The DFIR Report — Cyber threat intelligence and digital forensics research platform
• Check Point Research — Threat intelligence division of Check Point Software Technologies
• Garage2Global — IT service provider linked to BengalSEO infrastructure development
• BengalSEO — Financially motivated threat actor group