BengalSEO Campaign Poisons Bing Search Results

Cybersecurity researchers have detailed a significant search engine optimization (SEO) poisoning campaign, codenamed BengalSEO, which manipulates search engine results to distribute malware and facilitate tech support scams. The DFIR Report disclosed findings of this operation in March 2026, revealing that BengalSEO has been active since at least 2015. The campaign originates from the Indian state of Rajasthan and is reportedly orchestrated by two IT service providers, WeConnect and WebHopers. These entities are accused of employing sophisticated SEO tactics to elevate malicious websites in search engine rankings, specifically targeting users who search for popular software and services.

The primary objective of BengalSEO is to redirect unsuspecting users to fake download pages or fraudulent tech support websites. When users search for legitimate software, such as Adobe Acrobat Reader or VLC Media Player, on Microsoft's Bing search engine, BengalSEO manipulates the results to display links to compromised or fake versions of these applications. Upon downloading and attempting to install these malicious software packages, users are often infected with malware, including information-stealing trojans and potentially ransomware. In other instances, users are directed to fake tech support pages that mimic legitimate company interfaces, prompting them to pay for unnecessary or fraudulent technical assistance.

BengalSEO's operational methodology involves creating numerous websites and social media profiles that are heavily optimized with keywords related to popular software and common technical issues. These assets are then used to build backlinks and generate traffic, artificially inflating their search engine rankings. The campaign has demonstrated a particular focus on Bing, suggesting a deliberate strategy to exploit its search algorithm or user base. The DFIR Report's investigation identified specific infrastructure and tactics used by BengalSEO, including the use of cloaking techniques to hide malicious content from search engine crawlers while displaying it to human users. The campaign's longevity, spanning over a decade, highlights its resilience and the financial incentives driving such cybercriminal activities.

The impact of BengalSEO extends beyond immediate financial losses from fraudulent tech support calls. The malware distributed can lead to severe data breaches, identity theft, and further compromise of personal and corporate networks. The DFIR Report's analysis underscores the ongoing threat posed by sophisticated SEO poisoning campaigns that leverage search engines as a primary vector for cyberattacks. The involvement of IT service providers like WeConnect and WebHopers suggests a professionalized criminal enterprise rather than isolated actors, necessitating a coordinated response from cybersecurity firms, search engine providers, and law enforcement agencies to disrupt their operations and protect users.