The BengalSEO campaign, operated by Indian firms WeConnect Solutions and Garage2Global, uses sophisticated black hat SEO poisoning to distribute MayaBot malware and facilitate widespread tech support scams.

Key Points

• The BengalSEO operation has been active since at least 2015, utilizing advanced SEO techniques to manipulate Microsoft Bing search rankings.
• Attackers deploy MayaBot malware for system monitoring and cryptocurrency mining, or redirect victims to fraudulent call centers.
• The group leverages legitimate platforms like GitHub, ReadTheDocs, and Google Sites to host malicious lure pages and bypass security filters.
• A custom traffic distribution system uses Matomo analytics and CAPTCHA challenges to fingerprint victims and screen out automated security scanners.
• Researchers identified 84 active GitHub accounts linked to the campaign, with infrastructure heavily reliant on Cloudflare for proxying malicious traffic.

Why it Matters

This campaign demonstrates how threat actors weaponize the high reputation of trusted web platforms to deceive users and manipulate search engine algorithms at scale. By blending malicious payloads with legitimate-looking support portals, these groups pose a significant risk to both individual security and the integrity of online search results.