Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns

A phishing campaign uses over 300 fake domains impersonating mostly US financial institutions to target business banking and treasury logins. The phishing sites serve legitimate-looking login pages to first-time visitors but show fake 'account suspended' pages to returning visitors to evade takedown efforts. The campaign leverages Cloudflare to hide hosting details and uses IP tracking to differentiate visitors. This tactic complicates detection and takedown since security teams see only the fake suspended page on repeat visits. The campaign also targets victims in the UK, Australia, and New Zealand.

• securityweek.com/bank-phishing-sites-show-fake-suspended-pages-to-evade-takedowns/ (opens in a new tab)

• Grand Theft Auto VI Release Phishing LuresMalware2026-11-05
• Hackers Use Fake ChatGPT Plus Billing Emails to Steal Credit Card Details and OTP CodesCampaign2026-11-02
• How to download and read ebooks safely | Kaspersky official blogAnalysis2026-10-30
• Managed for Malice: How Attackers Turn MDM into Remote AccessCampaign2026-10-28
• How VBScript Malware Evades Detection Using Trusted Tools CopyMalware2026-10-27