Investigators described a real, long-running SEO poisoning operation (“BengalSEO”) that manipulates search results to push victims to fake support and activation pages. The pages impersonate well-known consumer brands, then route visitors through redirects and CAPTCHA checks to either download malware ("MayaBot") or call a tech-support scam number.
BengalSEO is a financially motivated operation that manipulates search engine results so that fake support and activation pages for popular consumer brands appear near the top of results. Victims searching for terms like "support" or "download" for products such as antivirus software, tax software, gaming platforms, or streaming services land on pages designed to look like official portals.
From there, a traffic distribution system routes visitors through rotating redirector domains. These domains use CAPTCHA challenges such as Cloudflare Turnstile or hCaptcha, not to protect users, but to filter out automated scanners and bots before serving the real malicious content. Depending on how the system classifies the visitor, the final landing page either pushes a malware download or a tech-support scam contact page.
When malware is served, the victim is prompted to download a ZIP archive and run its contents. Inside is a JavaScript dropper disguised as an EXE file. Once executed through wscript.exe, it installs the MayaBot malware. In other cases, no payload is delivered at all. Instead, the victim is redirected to a page urging them to call a support number, which connects them to a scam call center rather than any legitimate brand support line.
The operation succeeds because it exploits trust in search engine rankings. Users assume that a top result for a brand's support page is legitimate, especially when the page closely mimics the real brand's design and language. The use of CAPTCHA checks adds a false sense of legitimacy, since many users associate these challenges with safe, well-maintained websites rather than filtering tools used by attackers to evade detection.
Organizations and individuals can reduce exposure by treating search results for support and download pages as untrusted by default. Navigating to support resources through bookmarked or known official URLs, rather than search engine links, removes much of the risk. Staff should be trained to view unsolicited download or "run this file" instructions as a strong warning sign, and to verify any support phone number through an official website or internal IT channel rather than calling numbers presented by a pop-up or landing page.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
BengalSEO is a real, long-running SEO poisoning operation that manipulates search results to lead victims to fake support and activation pages impersonating popular consumer brands.
Victims who click through fake support pages download a ZIP file containing a JavaScript dropper disguised as an EXE. Once executed via wscript.exe, it installs the MayaBot malware.
In some cases no payload is served and the victim is instead redirected to a contact page prompting them to call a scam support number, since the operation is financially motivated and will pursue either outcome.
Watch for search results leading to unfamiliar domains rather than the brand's real site, ZIP downloads with run-this-file instructions, and pages urging you to call a generic support number.
You Google “Bitdefender support,” click the top result… and you’ve just walked into a BengalSEO trap. BengalSEO uses SEO poisoning to push fake support portals. You land on a Bitdefender-lookalike page with a huge “Get Started” button, a CAPTCHA, then a ZIP download that quietly drops MayaBot malware. Here’s the nasty part: after you open the ZIP and run the file, the site often bounces you to the real Bitdefender page, so you think everything’s fine. Other times, it flips to a fake tech-support screen pushing an 1-855 number to call. Aha moment: if you searched for “support” or “download” and land on an unfamiliar domain, stop. Don’t click the big button or call the number, go to the brand’s site or our IT portal by typing the URL yourself.
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
Microsoft reported a real-world campaign (“TerminalFix”) where attackers use compromised websites to show a fake Cloudflare CAPTCHA. The prompt tricks visitors into copying and running a malicious PowerShell/Terminal command, which then installs a reverse-tunnel backdoor that can give attackers…
A real malware campaign used compromised websites to show fake CAPTCHA/verification pages that tricked people into copying and running a PowerShell command themselves. That manual “copy/paste” step helped the attackers bypass normal download defenses and install the Cruciferra loader, which then…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
