A 10-Year Scam Operation Has Been Poisoning Your Bing Search Results

The Search Result Looked Legitimate. That Was the Point.

You searched for customer support. You clicked the top result. You called the number on the page. And somewhere between that search and that phone call, you handed your money to a criminal.

That is the BengalSEO playbook. Researchers exposed it publicly on September 8, 2026, and the operation has been running since at least 2015. Eleven years. Hiding in plain sight inside the search engine most people trust without thinking.

How Does It Actually Work?

The scam has two possible outcomes depending on which link you click, and neither one is good.

In the first scenario, you land on a fake brand support page built to look exactly like the real thing. The page quietly installs MayaBot malware on your device in the background. You might not notice anything for days or weeks.

In the second scenario, the page connects you to a live call center. A real human answers. They sound professional. They tell you your device has a serious problem. They charge you hundreds of dollars to fix an issue that never existed.

The people running these centers operate under two company names: WeConnect Solutions LLC, which runs the live call centers, and Garage2Global, which builds the fake web infrastructure. Both trace back to Rajasthan, India.

The technical piece that makes this possible is called black-hat SEO. Search engines rank pages partly based on signals like backlinks, domain authority, and content relevance. BengalSEO manipulates those signals artificially to push their fake pages above the real ones. On Bing specifically, their pages have been landing at the very top of results when people search for software and service support.

Most people never question the top result. That is the vulnerability this operation exploits.

The Numbers Behind a Decade of Deception

Researchers from The DFIR Report published their findings on August 24, 2026, after digging into the infrastructure behind the campaign.

What they found was not a small, sloppy operation. It was disciplined and deliberately structured to avoid detection.

The group maintained 84 or more GitHub accounts active between January 2024 and March 2026. That detail matters because commit metadata, the behind-the-scenes record of who edited code and when, exposed the companies' identities. Whoever built this infrastructure left fingerprints in their own version control system.

Eighty-one percent of the campaign's domains hide behind Cloudflare, which masks the real server addresses. Registrations run through Spaceship and Namecheap. The domains use .my, .shop, and .info extensions, chosen because they look credible to ordinary users who have been conditioned to see .com as suspicious but .shop as normal.

This is not a fly-by-night scam. The architecture reflects years of iteration and refinement.

What Should You Do Right Now?

1. Go directly to the brand's official website. If you need support for any software, app, or service, type the company's URL directly into your browser. Do not search for it. Do not call a phone number you found through a search. The only support number you should trust is one printed on product packaging, in your account dashboard, or on the official site you navigated to yourself.

2. Treat every top search result for support as a potential fraud. This applies to Bing especially, but no search engine is immune. Fake pages targeting popular software brands are designed to rank well. The top result is not a safety signal.

3. If you called a number you found in search results, watch your accounts. Check your bank and credit card statements for charges you do not recognize. If you gave remote access to your computer, change your passwords immediately, starting with your email and any financial accounts. Run a reputable antivirus scan.

4. Use a password manager and enable two-factor authentication everywhere. If malware did land on your device, it often targets saved passwords in browsers. A standalone password manager with two-factor authentication on your accounts limits what an attacker can do even if they get your credentials.

5. Consider a credit freeze. If you shared financial information during one of these calls, a credit freeze at the three major bureaus stops new accounts from being opened in your name. It is free and reversible.

6. Report it. File a report with the FTC at reportfraud.ftc.gov and with your state attorney general. These reports feed investigations. They also create a paper trail if you need to dispute charges later.

The Deeper Problem No Update Will Fix

Here is the uncomfortable truth sitting underneath all of this.

We built an internet where the top search result carries implicit authority. No one decided this consciously. It evolved from years of conditioning. Google returns the best result. Bing returns the best result. The top result is the right answer.

BengalSEO understood that assumption before most security researchers did, and they have spent a decade building a business on top of it.

Search engines are not curators. They are ranking systems. They can be gamed. A page that looks credible, ranks highly, and targets the right keywords will surface in results regardless of whether the people behind it have good intentions. Verification is not their core function. It is yours.

This will not be the last operation like BengalSEO. The infrastructure gets taken down, the domains rotate, and new ones appear. What changes the outcome is not better search algorithms alone. It is users who develop the instinct to navigate directly to official sources instead of trusting whatever the algorithm surfaces.

Do this now:

• Bookmark the official support pages for every service you use regularly
• Delete any phone numbers you found through a search engine and have not independently verified
• Tell someone you know who is not technical, because they are more likely to be targeted and less likely to question a top search result

Sources

• thehackernews.com
• thedfirreport.com