Image: thedfirreport.com · rights & removal
BengalSEO Part 1: Anatomy of the Operation
Reporting by The DFIR ReportRead the original at thedfirreport.com
Executive Summary
Facts Only
An SEO poisoning campaign resulting in malware deployment and tech support scams was identified in March 2026.
The operation is attributed to a group tracked as BengalSEO operating out of Rajasthan, India.
Two IT Service Provider companies were identified as main drivers of the operation.
These entities use SEO and web development to create lure pages with Black Hat SEO techniques.
A Traffic Distribution System (TDS) routes traffic using redirector domains.
The TDS uses Matomo analytics instances for tracking and fingerprinting visitors.
Custom malware named MayaBot was developed and used in the operations since 2022.
Lure pages mimicked technical support portals for various services between 2015 and 2026.
Delivery chain involved redirector domains, Cloudflare challenges, and payload delivery landing pages using domains like usttechnio[.]com.
Infrastructure included hosting on platforms such as github.io and pages.dev, and use of Domain registrars like Spaceship and Hostmaza.
GitHub accounts linked to the operation were identified, with activity peaking from Mid 2025 through early 2026.
Full Take
The narrative describes a highly integrated, long-term cyber-economic structure built on exploiting trust via search engine manipulation and sophisticated traffic obfuscation. The core pattern involves leveraging legitimate web development skills for malicious ends—creating high-visibility lure pages that function as deceptive entry points. The complexity of the delivery chain, utilizing dynamic redirector networks, behavioral fingerprinting via analytics, and content shuffling techniques to evade detection, suggests a system designed not just for immediate financial gain but for persistent, scalable evasion against detection mechanisms. This scale, evidenced by hundreds of registered domains and sustained activity from 2015 to 2026, indicates a mature operational methodology focused on laundering the threat and maximizing reach through algorithmic manipulation. The reliance on public platforms like GitHub for development infrastructure demonstrates an attempt to normalize malicious development within perceived legitimate channels, embedding the malicious code within recognizable digital artifacts. This suggests that the primary threat is not just malware execution but the systemic hijacking of digital visibility itself.
Bridge Questions:
What are the broader regulatory and legal frameworks currently failing to adequately address the use of pseudonymous developer infrastructure for large-scale fraud?
How can defensive systems be designed to detect patterns in DOM shuffling or dynamic content generation when the underlying traffic flow is heavily obscured by layered redirection services?
What mechanisms exist for tracing financial flows originating from these seemingly legitimate web development entities back to the ultimate beneficiaries of the SEO poisoning campaign?
From the original · The DFIR Report
Key Takeaways - In March 2026, a widespread SEO Poisoning campaign leading to malware deployment and tech support scams was identified by the DFIR Report. - This campaign was attributed to a scam operation operating out of Rajasthan, India, which our team has dubbed BengalSEO - Two IT Service Provider companies and their owners were identified as the main drivers for the BengalSEO operations…Read the full story at thedfirreport.com
Sentinel — Likely Synthetic
The text reads like a highly detailed forensic report generated from internal data rather than standard journalistic reporting; the specificity points strongly toward synthetic generation, though it mimics expert analysis very closely.