The DFIR Report has documented BengalSEO, a financially motivated operation running since at least 2015 that poisons Bing search results to deliver tech support scams and malware. It found the campaign in March 2026 and published in August.

The mechanics are ordinary black-hat SEO: backlinks, keyword stuffing, forums flooded with links, DOM injection, and DOM shuffling — randomising a page's HTML structure with JavaScript so that detection built on structural fingerprints stops matching. One Vizio setup page had 2,000 backlinks from 167 unique external domains pointed at it.

What arrives at the other end is a fake activation portal impersonating a streaming service, an antivirus product, gaming software or a tax utility. Some redirect to a contact page telling the visitor to phone a number about fraudulent account activity. Others deliver MayaBot, a custom implant in use since 2022 that handles command and control, monitors the system, and drops the XMRig Monero miner.

The part worth dwelling on is the attribution

This site spends most of its time doing the opposite of this. Last week it was pointing out that Chinese-language artifacts in source code tell you about a developer and not an operator, and that three threat clusters cited for three components is a sign of shared tooling rather than confident attribution.

So consistency requires saying the reverse when the evidence is good. Here it is good.

The DFIR Report links the operation to two entities: WeConnect Solutions LLC (formerly iConnect Soft Solutions LLC) and Garage2Global, based in Rajasthan, India, the latter publicly advertising website design and SEO services.

The link is not inferred from language, timezone or tooling overlap. It is email addresses in GitHub commit history, matching Garage2Global domains, across 84 GitHub accounts identified between January 2024 and March 2026. Account names include activate-uhc-com-ucard, capitalonecredit and help-line-center; associated addresses end in @wc.ci or are Gmail addresses containing "g2g".

Commit metadata is written by the developer's own git configuration. It is not a behavioural signal that requires interpretation — it is a name somebody typed once and then forgot was being recorded, repeated across dozens of accounts over two years. That is about as direct as public-source attribution gets.

Neither company appears to have responded, and no law enforcement action has been reported.

Why Bing, and an honest guess

Nothing in the reporting explains why Bing rather than Google, and it is the most interesting unanswered question here.

The obvious inference — and it is an inference, not a finding — is that Bing is the default search engine in Edge and in Windows, which is where a tech support scam finds people who will actually pick up the phone, and that its spam defences have historically had less adversarial pressure applied to them than Google's. Neither half of that is established by the report, so treat it as reasoning rather than evidence.

Microsoft has not commented.

Ten years is the other number

An operation running since 2015, with a custom implant since 2022, an infrastructure surge around August 2025, and activity continuing into 2026.

Ten years of the same business model, and it is a business model — the tracking domain stats.us3[.]org returns 1,112 urlscan.io results, which is what deliberate campaign measurement looks like. This is not opportunistic. Somebody was watching conversion rates.

The EtherHiding campaign we covered this week is the same shape from the other direction: compromise the path a person takes to find something, and you never have to break into anything.

Indicators

Payload delivery: ustechnio[.]com, tax.dll[.]lat, u320[.]my, reficon[.]pro, pltechoo[.]pro

Tracking: stats.us3[.]org

Example poisoned query: a search for "bitdefender central how to login" redirecting to a fraudulent readthedocs[.]io page.

What to do

  • Block the domains above and search historic DNS for them.
  • Treat search results as untrusted input for support and activation pages. The lure works because the victim went looking. Type vendor domains rather than searching for them.
  • Tell your users the shape of it, not the domains: a real vendor never asks you to call a number displayed on a page you found in search results.
  • Watch for XMRig, which is the noisiest thing in this chain and the easiest to catch.
  • If you run a forum or accept user-generated content, you are infrastructure here. Link spam is a delivery mechanism, not a nuisance.

What is not established

  • Initial access to the poisoned sites. The mechanism is not described.
  • Why Bing specifically.
  • Whether the operation is currently disrupted.
  • Any law enforcement action.
  • A response from either named company.