BengalSEO Poisons Bing to Spread MayaBot Malware — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- DFIR Report disclosed the BengalSEO campaign in March 2026, tracing it to India's Rajasthan state where it has operated since at least 2015 through IT service providers WeConnect Solutions LLC (previously iConnect Soft Solutions LLC) and Garage2Global, the latter of which publicly markets itself as a website design, SEO, and digital marketing company.
- MayaBot malware, deployed by BengalSEO since 2022, enables command-and-control (C2) operations, system monitoring, and delivers an XMRig cryptocurrency miner to infected machines via a JavaScript dropper executed through wscript.exe.
- BengalSEO weaponizes trusted hosting platforms including github.io, pages.dev, sites.google.com, and readthedocs.io, with 84 active GitHub accounts linked to Garage2Global email domains (wc[.]ci) detected between January 2024 and March 2026, with one Vizio decoy page racking up 2,000 backlinks from 167 unique external domains.
- BengalSEO lure pages use Black Hat SEO techniques like DOM shuffling, keyword stuffing, and backlinks to impersonate technical support and activation portals for streaming services, antivirus tools, gaming software, and taxation utilities, hijacking searches like "bitdefender central how to login" to surface at the top of Microsoft Bing results.
- The BengalSEO traffic distribution system uses Matomo analytics (and Google Tag Manager on some hosts) for client-side browser fingerprinting, screens automated traffic with Cloudflare Turnstile or hCaptcha challenges, and ultimately routes victims to either MayaBot ZIP downloads or scam call centers posing as Bitdefender support.
- Most BengalSEO infrastructure was registered since August 2025 through Spaceship (47.6%) and Namecheap (28.6%), with Cloudflare proxying 81.1% of domains and Hostmaza serving as the origin host for 10%, though one Hostmaza account managing redirector domains was already suspended earlier in 2026.
Why it matters: BengalSEO's decade of operation, 84 linked GitHub accounts, and infrastructure traceable to two named IT firms show that SEO poisoning at this scale functions less like cybercrime and more like a legitimate service business with malware bolted on — meaning Bing users searching routine support keywords face real infection risk, and the abuse of trusted platforms (GitHub Pages, Google Sites) forces search engines to reconsider how much trust signal they extend to user-generated hosting.
Ask SkimNews
