Search for your antivirus login and you might get a call centre in Kota
Type "bitdefender central how to login" into Bing and one of the results coming back may have been built for you by a company in Rajasthan. That is the kind of search The DFIR Report followed for months before publishing its findings on BengalSEO, an operation it traces back to at least 2015. Two businesses sit at the centre of it: WeConnect Solutions LLC, a tech support call centre in the city of Kota, and Garage2Global, which presents itself as a web design and marketing firm and builds the malicious infrastructure.
The scale is what makes it work. Researchers counted 84 GitHub accounts active between January 2024 and March 2026, hundreds of registered domains, and roughly 1,900 backlinks pointing at a single decoy page to shove it up the rankings. The pages themselves are hosted on services search engines already trust, github.io, pages.dev, sites.google.com and readthedocs.io, so the result looks respectable before you even click. The lures cover the things people genuinely go looking for help with: antivirus logins, tax software, Hulu, Paramount, Plex, Oculus, gift card activation for Amazon and Kohls. Click one and a chain of redirectors sizes up your browser first, then decides what you get. Some visitors are shown a download button that delivers MayaBot, custom malware the group has been using since 2022, which arrives inside a ZIP, launches through Windows' own wscript.exe and installs an XMRig cryptocurrency miner. Others land on a page saying their account has a security problem, with a number to ring.
Two habits defeat all of it. Reach a company's login page by typing its address into the bar yourself rather than searching for it, because a search result is an advertising slot with a ranking algorithm attached. And never dial a phone number a web page gave you, only one printed inside the app you already pay for.
A miner is built to be profitable rather than noticeable, so the symptom is a machine that runs hot and slow for no obvious reason. Tendvane's Health score gives you a plain read on how the PC is actually doing, and its Safety check lists what has appointed itself to start with Windows.