BengalSEO Part 1: Anatomy of the Operation

BengalSEO is a sophisticated SEO poisoning and tech support scam operation attributed to groups in Rajasthan, India, active since at least 2015 and publicly detailed in 2026. The campaign employs extensive black hat SEO methods such as backlink generation, DOM injection, and keyword stuffing to drive traffic to malicious lure pages mimicking legitimate tech support sites. A custom Traffic Distribution System with rotating redirector domains and Matomo analytics is used for victim routing and tracking. The operation deploys a custom malware named MayaBot to enable scam activities. Infrastructure analysis reveals hundreds of domains registered primarily through Spaceship and Namecheap, hosted on Cloudflare and Hostmaza, and leveraging GitHub for malicious content hosting. The campaign is not a software vulnerability but a complex threat actor operation involving malware distribution and social engineering scams.

The BengalSEO operation facilitates malware distribution and tech support scams, potentially leading to victim compromise through social engineering and malware infection. The use of custom malware MayaBot and sophisticated traffic routing increases the effectiveness of scams. The campaign can cause financial loss and data compromise for victims who engage with the malicious tech support portals. There is no direct software vulnerability exploited; the impact is through deception and malware delivery.

This is a threat actor campaign rather than a software vulnerability; therefore, no software patch or fix applies. Defenders should focus on user awareness to recognize tech support scams, block known malicious domains and IPs associated with BengalSEO infrastructure, and employ web filtering to detect SEO poisoning and malicious redirectors. Monitoring for indicators of compromise related to MayaBot malware and black hat SEO techniques is recommended. Since no official vendor advisory or patch exists, continuous threat intelligence updates are critical.