For millions of web users, search engines serve as the undisputed front door to the internet. When someone types a query into a search bar—whether looking for software downloads, customer service numbers, or technical troubleshooting guides—there is an implicit trust that the top results have been vetted for safety and relevance. However, cybercriminals have long understood that hijacking this trust offers a direct, highly efficient pipeline into victims' devices.
A striking example of this threat vector was unveiled when cybersecurity researchers detailed a massive, decade-long search engine optimization (SEO) poisoning campaign codenamed BengalSEO. Operating continuously since at least 2015 out of Rajasthan, India, the threat actor group behind BengalSEO has systematically gaming Bing search results to distribute malicious payloads, including the MayaBot infostealer, alongside coercive tech support scams.
The findings, originally uncovered by security analysis firm The DFIR Report, highlight a troubling reality: threat syndicates operating under the guise of legitimate IT service providers can sustain high-volume cybercrime operations for years while evading detection by search engine algorithms and security vendors alike.
Understanding the Mechanics of SEO Poisoning
To understand why BengalSEO has been so resilient, one must first look at the mechanics of modern SEO poisoning (also known as search poisoning or black-hat search manipulation). Unlike phishing campaigns that rely on sending millions of unsolicited emails that are frequently blocked by spam filters, search poisoning takes an inbound approach. Attackers create the trap and wait for unsuspecting users to walk in.
SEO poisoning campaigns typically rely on a combination of techniques:
- Automated Content Generation: Creating thousands of low-quality blogs or dynamic pages optimized for trending search terms, niche software names, or long-tail support queries.
- Compromised Websites: Hijacking vulnerable, high-authority websites—often running outdated WordPress or CMS platforms—and embedding hidden backlinks or redirect scripts to artificially boost the malicious site's rank.
- Cloaking Techniques: Serving clean, policy-compliant text to search engine crawlers (such as Bingbot) while delivering malicious scripts or deceptive redirects to real human visitors.
- Private Link Networks: Utilizing interconnected networks of domains owned or controlled by the attackers to pass authority and inflate domain rank rapidly.
When a user searches for a targeted term, the search engine's ranking algorithm perceives the attacker's page as popular, authoritative, and relevant. Consequently, the malicious link climbs to the top of the search engine results page (SERP). When the user clicks the link, web-based redirect chains analyze the visitor's location, browser, and operating system before delivering a tailored malicious payload.
Inside the BengalSEO Operation
The BengalSEO group represents a sophisticated evolution of cybercrime infrastructure. Rather than operating as isolated, anonymous hackers, the threat actors behind BengalSEO have conducted their campaigns under the umbrella of commercial IT service fronts based in Rajasthan, India. Operating through entities such as "WeConnect" and other associated IT services, the group blurred the lines between conventional digital marketing services and illicit cyber operations.
By leveraging legitimate corporate structures and infrastructure, BengalSEO managed to maintain operational continuity for over a decade. The group focused heavily on abusing Microsoft's Bing search engine, capitalizing on lower algorithmic competition compared to Google and exploiting the default integration of Bing across Windows desktop environments and Microsoft Edge browsers.
The operation’s business model relies on a dual-monetization strategy designed to extract maximum value from intercepted search traffic:
- Monetization Route A: Tech Support Scams. Non-technical users searching for customer support lines or software fixes are redirected to landing pages designed to simulate critical system errors, blue screens of death (BSOD), or urgent security alerts. The pages freeze the browser using aggressive JavaScript loops and display toll-free numbers operated by call centers in India. Unwary victims who call are coerced into paying hundreds of dollars for nonexistent repair services or granting remote access to their systems.
- Monetization Route B: MayaBot Malware Deployment. Users attempting to download free software, utilities, or cracks are presented with fake download buttons. Clicking these links triggers a multi-stage infection pipeline culminating in the installation of MayaBot.
The Technical Arsenal: Dissecting MayaBot
While tech support scams generate immediate cash flow from consumer targets, the deployment of MayaBot represents a far more insidious enterprise risk. MayaBot is a flexible information-stealing Trojan and botnet agent designed to quietly compromise corporate networks and personal endpoints.
Once a victim executes the poisoned installer downloaded via the BengalSEO redirect chain, the initial dropper executes several evasive maneuvers:
- Environment Checks: The payload verifies whether it is running in a virtual machine (VM) or sandbox environment used by security researchers. If an analysis tool is detected, execution halts silently.
- Persistence Mechanisms: The malware establishes persistence by adding scheduled tasks or altering Windows Registry run keys, ensuring it executes automatically upon system reboot.
- Credential and Data Harvesting: MayaBot scans local storage and web browser databases for saved passwords, session cookies, cryptocurrency wallet keys, and auto-fill data. Captured session tokens allow attackers to bypass multi-factor authentication (MFA) on enterprise platforms like Microsoft 365, Slack, and AWS.
- Botnet Infrastructure Integration: The compromised machine checks in with a command-and-control (C2) server, registering the machine's hostname, IP address, and system specifications. The attackers can then use the infected system as a proxy node, deploy secondary malware such as ransomware, or rent access to the machine on dark web cybercrime forums.
By combining high-volume consumer fraud with targeted infostealer deployment, BengalSEO maximizes its return on investment for every user who clicks on a poisoned search result.
Why Search Engines Struggled to Stop BengalSEO
The decade-long lifespan of BengalSEO raises significant questions about the security architectures of major search engines. Why was Bing unable to curb this widespread manipulation for so many years?
The answer lies in the structural tension between search engine performance and real-time security inspection. Search engines prioritize indexing speed, freshness, and scale. Crawling billions of web pages daily requires automated bots that analyze static page elements, HTML metadata, and link structures. However, advanced threat actors use dynamic cloaking—inspecting HTTP request headers, IP addresses, and canvas fingerprinting—to hide their malicious logic from search crawlers.
When a Bing crawler visits a BengalSEO domain, it sees a benign, SEO-optimized article about system performance. When a human user in North America clicks that same link from a Edge browser, the backend server responds with a dynamic script redirecting them to a MayaBot dropper or a tech support lock-screen.
Furthermore, Microsoft’s deep integration of Bing across Windows OS search bars, Edge homepage feeds, and AI-assisted search tools creates a massive built-in user base. For threat actors, ranking highly on Bing provides immediate access to millions of desktop users who default to built-in system search tools.
Strategic Countermeasures for Enterprises and Users
The disclosure of the BengalSEO campaign highlights the necessity of layered defense strategies that extend beyond traditional email and network perimeters. Relying on search engine algorithms to filter out malicious links is no longer a viable security strategy.
Organizations and security teams should implement the following protective measures:
1. Robust Web Filtering and DNS Protection
Deploy Secure Web Gateways (SWG) and DNS-level filtering solutions capable of inspecting encrypted traffic (TLS/SSL inspection) and analyzing real-time page content. Blocking newly registered domains (NRDs) and categorizing unverified sites can stop redirect chains before the payload reaches the browser.
2. Endpoint Protection and Credential Guarding
Modern Endpoint Detection and Response (EDR) platforms should be configured to detect suspicious process spawning—such as web browsers launching command-line utilities (cmd.exe, powershell.exe) or writing unauthorized files to temp directories. Enforcing strict FIDO2-based MFA reduces the impact of session token theft caused by infostealers like MayaBot.
3. User Awareness Beyond Phishing
Traditional security awareness training focuses overwhelmingly on email phishing. Security programs must educate employees on the risks of search engine poisoning, emphasizing that top search results—even on legitimate search engines—can lead to malicious downloads, fake software updates, or fraudulent phone numbers.
4. Browser Hardening and Ad-Blockers
Deploying enterprise-grade ad-blocking extensions or browser policies that disable JavaScript execution on untrusted domains can neutralize browser-locking tech support scripts and block automated redirect chains.
The Broader Trend: Commercialized Cybercrime Fronts
BengalSEO is not an isolated phenomenon; it represents a broader systemic issue in the global cybersecurity landscape: the commercialization of cybercrime behind legitimate corporate entities. Operating out of jurisdictions where regulatory oversight of IT services may be inconsistent, these threat syndicates operate with near-impunity, blending legitimate Web development services with black-hat manipulation and malware distribution.
As search engines incorporate generative AI and automated indexing deeper into their platforms, the battle against search poisoning will only intensify. Threat actors will increasingly leverage AI to generate thousands of unique, convincing web pages at negligible cost, overwhelming traditional algorithmic defenses.
The unmasking of BengalSEO by security researchers serves as a critical reminder that the search bar is an active attack vector. Until search providers implement stricter real-time execution sandboxing and deeper behavioral analysis during link indexing, users and organizations must approach search engine results with the same defensive scrutiny applied to unexpected email attachments.
