Innovative Camouflage Mechanism
Cybersecurity firm Kela has detected a sophisticated phishing campaign targeting financial institutions, where attackers rely on a deceptive technique that prevents security teams and takedown service providers from detecting malicious content. This campaign relies on logging visitors' IP addresses; while the first visitor sees a fake banking login page, any subsequent visitor (including security scanning tools) encounters a page that appears to be an "account suspended" notice from a hosting provider, suggesting that the site has already been taken down.
Why This News Matters
The danger of this infrastructure lies in its ability to bypass traditional protection measures. When a security team or service provider reports a suspicious site, they usually check it again to confirm the takedown. In this case, the fake page appears to investigators, leading them to classify the domain as "inactive" while the site continues to target new victims. This tactic makes it difficult for incident response teams to effectively stop the campaign, as uncovering the real content requires using a new IP address for each inspection.
Campaign Details and Scope
The campaign began in May 2026 and expanded to include over 300 fake domains, 248 of which targeted about 189 US financial institutions, with a special focus on mid-sized regional banks. Investigations also showed that the campaign extends to victims in the United Kingdom, Australia, and New Zealand. The sites use naming patterns relying on words like "secure" or "authorize" followed by the bank's name, with a new category emerging that uses labels like "help-desk" and "live-support" to mimic technical support portals.
Mitigation Challenges
Kela identifies four factors that make this infrastructure difficult to stop:
- Simple naming format: Can be easily replicated for any financial institution.
- Use of Cloudflare: To hide the actual hosting location.
- Camouflage technique: Displaying a "suspended" page on the second visit to mislead scanners.
- Shared servers: Which ensure campaign continuity even if a single domain is taken down.
The findings indicate that the campaign primarily targets business banking and treasury credentials, and uses scripts to prevent the use of developer tools in browsers, further complicating the technical analysis process of the site.