This threat describes an ongoing, large-scale phishing campaign targeting U.S. banking users by impersonating ESL Federal Credit Union and other financial organizations. The attackers use a multi-step phishing process to harvest login credentials, OTPs, and email verification information, facilitating account takeover and fraud. The campaign infrastructure is highly reusable and rotates through hundreds of phishing domains, mainly in less common top-level domains. Data exfiltration involves chained POST requests and Telegram bots controlled by the attackers. Despite frequent domain changes, consistent phishing page assets allow tracking of the campaign. The campaign has been active since November 2025 with sustained high-volume activity.

The campaign poses a significant risk of account takeover and financial fraud for targeted U.S. banking users by stealing credentials and OTPs. The multi-step phishing flow increases the likelihood of successful credential harvesting and bypassing of multi-factor authentication. The use of numerous rotating domains and persistent infrastructure complicates detection and takedown efforts. However, this is a phishing campaign rather than a software vulnerability or exploit, so the impact is limited to social engineering and credential theft.

No official patch or vendor advisory is available for this phishing campaign. Mitigation should focus on user education to recognize phishing attempts, monitoring for suspicious login activity, and employing strong multi-factor authentication methods that do not rely solely on OTPs sent via SMS or email. Financial institutions should monitor for and report phishing domains impersonating their services to domain registrars and take down fraudulent sites. Users are advised to verify URLs carefully and avoid entering credentials on suspicious sites. Since this is a phishing campaign, technical patching is not applicable.