Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own Takedown

A sophisticated phishing campaign targets 189 US financial institutions using 248 look-alike domains that combine urgency keywords with bank names. The campaign uses a cloaking technique that shows fake "account suspended" pages to returning visitors while delivering real phishing content to first-time visitors, evading takedown attempts. It focuses on business banking and treasury portals, which typically have higher balances and transfer capabilities. The domains are hosted behind Cloudflare and traced to shared servers at two providers. Network analysis links this operation to a centralized backend managing additional phishing campaigns targeting institutions in the UK, Netherlands, Australia, and New Zealand. The campaign is administered via a jump server accessed through Remote Desktop from a UK residential broadband connection, providing a lead to the operator's identity.

• From Business Emails to XLoader: An Order Lure That Led to In-Memory InjectionMalware2026-11-04
• Inside a malicious Claude Code-branded extension and its persistent SSH backdoorMalware2026-10-31
• Hackers Use Fake ChatGPT Plus Billing Emails to Steal Credit Card Details and OTP CodesCampaign2026-11-02
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• Black October for AI Developer PlatformsCampaign2026-10-31