Full Report
Cybersecurity researchers have disclosed details of a sprawling search engine optimization (SEO) poisoning campaign that paves the way for malware deployment and tech support scams. The campaign, discovered by the DFIR Report in March 2026, has been codenamed BengalSEO. It has operated out of the Indian state of Rajasthan since at least 2015, driven by two IT service providers named WeConnect
Analysis Summary
# Tool/Technique: BengalSEO (MayaBot & Black Hat SEO Campaign)
## Overview
BengalSEO is a long-running, sprawling search engine optimization (SEO) poisoning and malware delivery campaign operated by threat actors based in Rajasthan, India. The operation uses sophisticated web development and "Black Hat" SEO techniques to manipulate search engine rankings (specifically Bing), directing users to lure pages that deploy custom malware or facilitate tech support scams.
## Technical Details
- **Type:** Malware family (MayaBot) and Traffic Distribution System (Technique/Infrastructure).
- **Platform:** Windows (MayaBot / XMRig); Web Browsers (SEO/TDS).
- **Capabilities:** Command-and-Control (C2), system monitoring, cryptocurrency mining, browser fingerprinting, and traffic redirection.
- **First Seen:** 2015 (Campaign infrastructure); 2022 (MayaBot).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link (via SEO Poisoning)]
- **[TA0002 - Execution]**
- [T1204.001 - User Execution: Malicious Link]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information (DOM Shuffling)]
- [T1548 - Abuse Elevation Control Mechanism (Bypassing scanners with hCaptcha/Turnstile)]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
- **[TA0040 - Impact]**
- [T1496 - Resource Hijacking (Cryptomining)]
## Functionality
### Core Capabilities
- **SEO Poisoning:** Uses keyword stuffing and DOM injection to place malicious links at the top of search results for technical support, antivirus downloads, and streaming service activations.
- **MayaBot Malware:** Acts as the primary payload, providing C2 capabilities and system monitoring.
- **Resource Hijacking:** Deploys XMRig to mine Monero (XMR) cryptocurrency on the victim's machine.
- **Tech Support Scams:** Routes traffic to fraudulent call centers to dupe victims into paying for fake services.
### Advanced Features
- **Traffic Distribution System (TDS):** A sophisticated gating mechanism that tracks, filters, and directs traffic based on victim profile.
- **DOM Shuffling:** Dynamically reorders HTML elements via JavaScript to make identical lure pages appear unique to web crawlers, bypassing automated spam filters.
- **Anti-Analysis:** Employs Cloudflare Turnstile and hCaptcha to block automated security scanners and bots from reaching the final payload.
- **Victim Fingerprinting:** Integrates Matomo (legitimate analytics) to profile browsers and track campaign performance.
## Indicators of Compromise
- **File Hashes:** *Specific hashes not provided in the article text; refer to DFIR Report for SHA256.*
- **File Names:** `MayaBot.exe`, `xmrig.exe`
- **Network Indicators:**
- stats.us3[.]org (Matomo tracking)
- viziocomsetupentercode.github[.]io (Lure page)
- readthedocs[.]io (Used for hosting bogus links)
- **Behavioral Indicators:** High CPU usage (XMRig mining), unauthorized redirects in the browser, and PowerShell execution from browser processes.
## Associated Threat Actors
- **WeConnect Solutions LLC** (formerly iConnect Soft Solutions LLC)
- **Garage2Global**
## Detection Methods
- **Signature-based detection:** Identify known MayaBot strings and XMRig configuration files.
- **Behavioral detection:** Monitor for high-volume backlink generation from single sources and detect "DOM Shuffling" patterns where HTML structures change rapidly on page refresh.
- **Web Traffic Analysis:** Alert on redirects involving known TDS infrastructure and unexpected Matomo tracking domains (e.g., stats.us3[.]org).
## Mitigation Strategies
- **User Training:** Educate users to verify URLs for "official" support sites and avoid clicking "Get Started" buttons on third-party documentation sites like ReadTheDocs for official software.
- **Endpoint Protection:** Use EDR solutions to block the execution of unauthorized miners and credential stealers.
- **Ad-Blocking/Web Filtering:** Implement robust web filtering to block known TDS and redirector domains.
- **Browser Security:** Enforce the use of modern browsers that flag suspicious sites and block automated redirects.
## Related Tools/Techniques
- **GootLoader:** Similar in its heavy reliance on SEO poisoning for initial access.
- **Sykipot:** Known for redirect-based infection chains.
- **Black Hat SEO:** General category of techniques used to manipulate search algorithms.