BengalSEO Campaign Hijacks Bing Search to Spread Malware and Scams

How BengalSEO Exploits Search Rankings to Deceive Users

Cybersecurity researchers have uncovered a large-scale search engine optimization poisoning operation named BengalSEO that manipulates Bing search results to deliver malware and tech support fraud. Discovered by the DFIR Report in March 2026, the campaign has been active for several months, using deceptive web pages to trick users into downloading harmful software or calling fake support lines. The operation primarily targets individuals searching for technical help or software downloads, redirecting them to malicious sites designed to mimic legitimate services.

The attackers employ black-hat SEO techniques to elevate fraudulent websites in Bing’s search rankings for high-traffic keywords related to software tools, drivers, and system utilities. When users click on these seemingly legitimate results, they are led to pages that either automatically download malware like MayaBot or display alarming pop-ups claiming their device is infected. These fake warnings urge users to contact a toll-free number, where scammers pose as technicians to gain remote access or sell unnecessary services. The DFIR Report noted that the infrastructure behind BengalSEO is highly distributed, making it difficult to dismantle quickly.

What Makes This Campaign Particularly Difficult to Counter

Unlike typical phishing schemes that rely on email, BengalSEO exploits trust in search engine results, making it harder for average users to detect the threat. The campaign continuously rotates domains and uses compromised legitimate websites to host malicious content, evading traditional security filters. Researchers observed that the malware payloads often include information stealers and backdoors, enabling long-term access to victim systems. The use of Bing, rather than Google, suggests the attackers may be exploiting perceived gaps in Bing’s spam detection or indexing policies.

What is MayaBot and how does it harm users? MayaBot is a type of malware distributed through the BengalSEO campaign that can steal passwords, capture screenshots, and allow attackers to control infected computers remotely. It often arrives disguised as a legitimate software update or utility tool.

Frequently Asked Questions

Why are tech support scams effective in this campaign? The scams succeed by creating a sense of urgency through fake virus alerts, prompting users to act quickly without verifying the legitimacy of the warning. Once connected, scammers use social engineering to extract payment or install additional malware.

Can users protect themselves from BengalSEO-related threats? Users should avoid clicking on sponsored or unfamiliar search results, especially for software downloads, and verify website URLs before proceeding. Using updated antivirus software and enabling browser protections against malicious sites can also reduce risk.