BengalSEO: The Decade-Old Rajasthan Operation Poisoning Bing Results
Researchers say two Indian IT firms have quietly gamed search engines since 2015 to push malware and fake tech-support pop-ups.
Key points
- The DFIR Report disclosed the BengalSEO campaign in March 2026 after tracking it back to at least 2015.
- The operation runs out of Rajasthan, India, powered by two IT service providers trading as WeConnect.
- Poisoned search results push victims toward malware downloads and fake tech-support scams.
- The scheme mainly targets people using search engines like Bing to look up everyday queries.
- Ordinary users can protect themselves by ignoring urgent pop-ups that demand a phone call to "Microsoft support".
A decade-old scheme to trick search engines into serving booby-trapped links has finally been dragged into daylight. Researchers at the DFIR Report published their findings in March 2026, giving the operation a name: BengalSEO. Eleven years. That's how long this has apparently been running without a public name attached to it.
What is SEO poisoning, in plain English?
SEO poisoning is when criminals manipulate a search engine into ranking their malicious pages near the top of results for popular searches. Search engine optimisation, or SEO, is the ordinary business of getting your website to appear on Google or Bing. The criminal version hijacks that same machinery.
You search for a printer driver or a song lyric. The top result looks legitimate. You click. Instead of the file you wanted, you land on a page that downloads malicious software onto your machine or throws up a full-screen warning telling you your PC is infected and to call a number for "Microsoft support". That call goes to a scam call centre, not Microsoft.
Who is behind BengalSEO?
The DFIR Report attributes the campaign to two IT service providers based in Rajasthan, both operating under the WeConnect name. The outfit has been running the scheme since at least 2015, making it one of the longest-lived SEO poisoning operations documented publicly.
The group runs two revenue streams in parallel: malware delivery for one set of customers, tech-support scam traffic for another. Both need the same input, people clicking poisoned links. Our 7 September report "Hackers Are Hijacking Remote-Support Software to Spread Malware Across Whole Networks" showed how a fake tech-support call can end with criminals inside an entire corporate network, which gives some context for why this funnel is worth maintaining for eleven years.
What is actually being served to victims?
Two payloads, depending on the lure.
The first is malware: software designed to steal information or hand the attackers remote control of the machine. The second is a scam page that locks the browser, plays an alarm, and tells the user to phone a number urgently. Anyone who calls is walked through handing over remote access or paying hundreds of dollars for fake repairs.
| Detail | What the researchers found |
|---|---|
| Campaign name | BengalSEO |
| Disclosed by | The DFIR Report, March 2026 |
| Origin | Rajasthan, India |
| Active since | At least 2015 |
| Operators | Two IT firms trading as WeConnect |
| Payloads | Malware and tech-support scam pages |
Should ordinary internet users be worried?
A little caution goes a long way. SEO poisoning works because the malicious link sits inside search results you already trust, not arriving in a suspicious email.
Check the web address under a result before clicking, particularly if the domain's unfamiliar. Never phone a number that pops up in your browser warning you about an infection: real operating-system alerts don't include phone numbers. If a download starts on its own after a search, close the tab immediately.
Businesses have a role too. Endpoint protection catches many of the payloads BengalSEO delivers, and browser isolation stops the pop-up scams from ever reaching the desktop.
Common questions
Is Bing the only search engine affected?
SEO poisoning campaigns target whichever search engine is easiest to manipulate for a given query. Bing has featured prominently in recent write-ups, but the underlying trick works against any search engine.
How do I know if I called a scam tech-support number?
If you were asked to install remote-access software, hand over a credit card, or buy gift cards to pay for support, it was a scam. Disconnect the machine from the internet, run a full antivirus scan, and contact your bank if you paid anything.
