Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns
A threat actor has been relying on fake ‘suspended account’ notices to hide phishing content from users revisiting its look-alike bank websites, cybersecurity firm Kela reports.
The campaign, active since May, has been relying on more than 300 fake domains, including 248 impersonating 189 US financial institutions. The first were registered in late 2025, but most of them appeared between July and September 2026.
As of October 25, 183 of the targeted organizations still had live look-alikes, mainly targeting mid-sized regional banks. Last week, 49 new domains appeared.
“What ties them together is one mechanism: the kit remembers every visitor’s IP address, so the first visit gets a bank login page, and any return visit gets what looks like a closed hosting account. We call this cluster the ‘Suspended’ infrastructure,” Kela notes.
Most of the identified domains follow a similar naming pattern containing a keyword such as ‘secure’, ‘disable’,...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
