Researchers uncovered a long-running “SEO poisoning” operation that manipulates Bing search results to push people onto fake support and activation pages. Victims are steered through a chain of redirects to either download a malware-laced ZIP (MayaBot) or be pressured into calling a fake tech-support call center. The campaign relies on trusted hosting platforms and heavy backlink spam to make the fake pages look legitimate and rank highly.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You search Bing for “bitdefender central how to login”… click the top result… and that’s exactly how BengalSEO gets you. Their SEO poisoning pushes you to a fake Bitdefender Central page on readthedocs.io with a giant “Get Started” button. Click it, and you’re funneled through redirects to a “Download for Windows” ZIP that secretly drops MayaBot. Same trick, different ending: sometimes the redirects land on a “Suspicious activity linked to your Bitdefender Central account” page that flashes a phone number and tells you to call support, that’s a BengalSEO scam call center. Aha moment: the top Bing result and a familiar host like readthedocs.io don’t prove it’s legit. One move: before you click any big button or call any number, check the domain in the address bar, if it’s not the real vendor site, back out.
Investigators described a real, long-running SEO poisoning operation (“BengalSEO”) that manipulates search results to push victims to fake support and activation pages. The pages impersonate well-known consumer brands, then route visitors through redirects and CAPTCHA checks to either download…
Researchers tied Mirage Kitten to a job-recruiting scam that targets developers via LinkedIn and job platforms. Victims are sent a “technical assessment” ZIP file hosted on legitimate cloud storage; running the project silently installs a remote-access trojan (NodeRabbit) that lets attackers…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Cofense reports multiple real-world campaigns where attackers don’t hack the browser, they trick employees by copying normal browser experiences like login pop-ups, software update prompts, and “verification” checks. The goal is to get users to enter credentials, approve attacker sessions, or run…
