A sprawling cybercrime operation called BengalSEO has been manipulating Microsoft Bing search results for more than a decade to deliver malware and funnel victims into tech support scams. Researchers at the DFIR Report traced the campaign to two IT firms in the Indian state of Rajasthan — WeConnect Solutions LLC and Garage2Global — which have been running fake technical-support and software-download pages since at least 2015.
The group’s lure pages impersonate legitimate services: antivirus activation portals (such as a fake Bitdefender login page), streaming service subscriptions, tax utilities, and even gaming-software downloads. When a victim clicks a Bing result for a query like “bitdefender central how to login,” they are routed through a series of redirect domains that fingerprint their browser and either push a malware payload or connect them to a scam call center. The malware — a custom tool named MayaBot — establishes a command-and-control channel and drops an XMRig cryptocurrency miner on the infected device. BengalSEO uses black-hat techniques including backlink spam, DOM injection, and keyword stuffing to keep its fake pages ranking highly in Bing results.
How to check if you’re affected
Affected products include any software or browser extension downloaded from a page promoted in Microsoft Bing search results for antivirus tools, streaming service activations, tax software, or gaming utilities. If you recently searched Bing for security or productivity software and were redirected through multiple pages before reaching a download, scan your system with a trusted security tool to check for unknown processes or cryptocurrency miners. Look for unfamiliar executables running in Task Manager and revoke any browser extensions you did not deliberately install.