Cybercriminals operating a large-scale bank-phishing campaign have adopted a sophisticated method to evade takedown efforts: presenting malicious websites as inactive to security teams while continuing to target new victims. According to cybersecurity firm Kela, the campaign’s phishing infrastructure records each visitor’s IP address. First-time visitors are directed to convincing counterfeit bank login pages, whereas returning visitors from the same IP address are shown a fabricated “account suspended” notice. This technique creates the impression that the domain has already been shut down, allowing the operation to remain active while undermining verification processes.
The campaign has been active since May and employs more than 300 fraudulent domains. Of these, 248 impersonate 189 financial institutions in the United States, with most domains registered between July and September 2026. As of October 25, 183 of the targeted organizations still had live look-alike websites. The operation primarily focuses on mid-sized regional banks and appears designed to obtain business-banking and treasury credentials rather than personal account credentials. Kela also identified 49 newly registered domains during the final week of October, indicating that the network remains active and expanding.
The fraudulent domains follow recognizable naming conventions intended to increase their apparent legitimacy. Many incorporate terms such as “secure,” “disable,” “protect,” “cancel,” “authorize,” “terminate,” “credentials,” or “commercial,” followed by the name of the targeted bank. A smaller but growing group uses domains resembling help desks, live-support portals, treasury portals, and “primary device” pages. Examples include look-alike domains associated with JPMorgan, Citi, BMO, and Santander. These naming patterns are designed to make the links appear urgent, official, and relevant to customers concerned about account security or payment issues.
When a first-time visitor accesses one of these pages, the site displays the targeted bank’s branding and requests a user ID and password. Some pages also include a reCAPTCHA to reinforce the appearance of legitimacy. The browser tab is titled “Attention required,” imitating Cloudflare’s challenge page, while embedded scripts attempt to prevent users from accessing browser developer tools. Upon a subsequent visit from the same IP address, however, the page displays a fake hosting-provider suspension notice. This cloaking technique is specifically intended to disrupt the standard security workflow, in which analysts verify a reported site and then recheck it to confirm that it has been removed.
The infrastructure is difficult to dismantle because it incorporates several defensive measures: easily repeatable domain-naming conventions, Cloudflare services that obscure the actual hosting location, IP-based cloaking, and shared servers capable of hosting new phishing domains after individual sites are removed. Kela also identified alternative evasion methods, including blank pages, blocking notices, and redirects to Google, which prevent public scanning services from fully documenting the campaign. Although the firm has not determined how victims are initially directed to the phishing pages, it found that the operation also targets victims in the United Kingdom, Australia, and New Zealand. Users are advised to avoid links in unsolicited communications and to access banking services directly through official applications or saved bookmarks.
Read the original article: