BengalSEO SEO poisoning campaign
Campaign
Summary
Hide ▲
Show ▼
The BengalSEO operation now stands out as a long-running SEO poisoning campaign that funnels search users into MayaBot malware delivery and tech support scams. Discovered in March 2026 and active since at least 2015, it uses lure pages, redirector chains, and a traffic distribution system to hide final payload and scam destinations. The scale matters because the operation manipulates search rankings across many domains and hosting services, making malicious results look legitimate.
Related Happenings
MayaBot malware activity in BengalSEO
Malware Activity
H score10
First: 08.09.2026 11:43
Last: 08.09.2026 11:43
Sources 1
How related:
One of the payloads is a custom malware dubbed MayaBot, which is responsible for enabling command-and-control (C2), system monitoring, and delivering an XMRig cryptocurrency miner.
About this happening:
The MayaBot payload now anchors a Windows malware operation that gives BengalSEO command-and-control (C2), system monitoring, and XMRig mining capability, incr...
MayaBot malware activity in BengalSEO
Malware ActivityHow related: One of the payloads is a custom malware dubbed MayaBot, which is responsible for enabling command-and-control (C2), system monitoring, and delivering an XMRig cryptocurrency miner.
About this happening: The MayaBot payload now anchors a Windows malware operation that gives BengalSEO command-and-control (C2), system monitoring, and XMRig mining capability, incr...
SourTrade malvertising campaign impersonating trading and cryptocurrency brands
Campaign
H score34
First: 07.09.2026 10:53
Last: 07.09.2026 10:53
Sources 1
About this happening:
The SourTrade malvertising campaign remains active, using lookalike portals and malicious JavaScript to target retail traders and cryptocurrency investors across *...
SourTrade malvertising campaign impersonating trading and cryptocurrency brands
CampaignAbout this happening: The SourTrade malvertising campaign remains active, using lookalike portals and malicious JavaScript to target retail traders and cryptocurrency investors across *...
Gambling Goblin Brazilian SEO fraud campaign
Campaign
H score35
First: 02.09.2026 17:00
Last: 02.09.2026 17:00
Sources 1
About this happening:
Check Point Research says Gambling Goblin is a Chinese-speaking cybercrime cluster running a sustained SEO fraud operation against Brazilian government and educa...
Gambling Goblin Brazilian SEO fraud campaign
CampaignAbout this happening: Check Point Research says Gambling Goblin is a Chinese-speaking cybercrime cluster running a sustained SEO fraud operation against Brazilian government and educa...
WeedHack YouTube and SEO poisoning campaign targeting Minecraft players
Campaign
H score73
First: 03.06.2026 00:54
Last: 03.06.2026 00:54
Sources 1
About this happening:
WeedHack is a Minecraft-focused malware campaign that uses SEO poisoning, YouTube, and fake gaming sites to push malicious clients and other downloads to players....
WeedHack YouTube and SEO poisoning campaign targeting Minecraft players
CampaignAbout this happening: WeedHack is a Minecraft-focused malware campaign that uses SEO poisoning, YouTube, and fake gaming sites to push malicious clients and other downloads to players....
Nimbus Manticore multi-wave aviation and software phishing and SEO poisoning campaign
Campaign
H score36
First: 26.05.2026 10:13
Last: 26.05.2026 10:13
Sources 1
About this happening:
Nimbus Manticore's February-April 2026 campaign widened into multi-wave phishing and SEO poisoning, increasing risk to organizations in the U.S., Europe, and the Middle...
Nimbus Manticore multi-wave aviation and software phishing and SEO poisoning campaign
CampaignAbout this happening: Nimbus Manticore's February-April 2026 campaign widened into multi-wave phishing and SEO poisoning, increasing risk to organizations in the U.S., Europe, and the Middle...
Timeline
-
08.09.2026 11:43 2 articles · 1d ago
Researchers disclose BengalSEO SEO poisoning campaign
Initial DisclosureCybersecurity researchers disclosed a sprawling SEO poisoning campaign called BengalSEO that has operated from Rajasthan, India since at least 2015 through WeConnect Solutions LLC and Garage2Global. The operation uses lure pages, redirector chains, and a traffic distribution system to push MayaBot malware, XMRig mining, and tech support scams.
Show sources
- BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams — thehackernews.com — 08.09.2026 11:43
- BengalSEO Poisons Bing Search Results to Deliver MayaBot and Tech Support Scams — thehackernews.com — 08.09.2026 11:43