BengalSEO: SEO Poisoning Campaign Discovered

Cybersecurity researchers have discovered an extensive search engine optimization (SEO) campaign known as BengalSEO. This campaign aims to spread malware and conduct technical support fraud. The details were published in March 2026 by the DFIR Report and indicate that the activities have been operating from the Indian state of Rajasthan since at least 2015. The campaign is driven by two IT service providers, WeConnect and another unnamed provider. These companies have created a variety of websites filled with fake content to increase visibility in search engines.

The researchers identified that the websites are often optimized with misleading keywords that are frequently searched by users needing technical support. A central element of the BengalSEO campaign is the use of fake support numbers displayed on the manipulated websites. These numbers lead to call centers where fraudsters attempt to obtain personal information from victims or persuade them to download harmful software. The fraudsters often impersonate employees of large technology companies to build trust. The researchers reported that the campaign targets not only the Indian market but also operates internationally.

Users from various countries, including the USA and European states, are affected. The spread of the malware often occurs through links placed on the manipulated websites, and users are lured into clicking these links. Security analyses show that the malware disseminated through this campaign has various functions, including stealing passwords and spying on user data. The researchers have identified several variants of the malware that have been active in recent months. This malware can also function as ransomware, encrypting victims' data and demanding a ransom.

The DFIR Report has documented the affected websites and their associated IP addresses. The analysis revealed that the campaign has intensified in recent months. Researchers recommend that users exercise caution with search results and refrain from providing personal information to unknown sources. The discovery of BengalSEO raises questions about the effectiveness of current security measures. Experts are calling for increased collaboration between search engine providers and security researchers to combat such fraudulent attempts.

The need to improve algorithms for detecting manipulated content is considered crucial. Authorities in India have already taken initial steps to take action against the operators of the campaign. Legal measures against the responsible companies are expected to be initiated. The Indian cybercrime unit has announced plans to intensify investigations to identify the masterminds behind the operation.

The DFIR Report estimates that the campaign has affected several thousand victims worldwide in recent years. However, the exact number of affected users is difficult to determine, as many victims do not report incidents out of fear of further fraud. Researchers advise using security software and regularly updating it to protect against such threats. The security vulnerability CVE-2026-1234, associated with this campaign, reportedly affects around 50,000 systems in Germany, according to the BSI.