𝗨𝗦 𝗕𝗮𝗻𝗸𝗶𝗻𝗴 𝗨𝘀𝗲𝗿𝘀 𝗧𝗮𝗿𝗴𝗲𝘁𝗲𝗱 𝗶𝗻 𝗟𝗮𝗿𝗴𝗲-𝗦𝗰𝗮𝗹𝗲 𝗢𝗧𝗣 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴 𝗖𝗮𝗺𝗽𝗮𝗶𝗴𝗻

We’re tracking a large-scale phishing campaign impersonating ESL Federal Credit Union, a U.S. financial institution, with ongoing high-volume activity observed since November 2025. The infrastructure and flow are highly reusable and can be quickly adapted to impersonate other financial organizations.

The campaign uses a multi-step phishing flow to steal usernames, passwords, OTP codes, and email verification data, creating serious account takeover and fraud risk at this scale.

Unlike short-lived phishing operations, this activity has remained active for months with constantly rotating infrastructure. More than 230 phishing domains have already been identified, most registered in .sbs, .cfd, and .click zones.

After credential submission, victim data is sent through a chain of POST requests and forwarded to Telegram bots through attacker-controlled iframe responses. The campaign then moves into a second phishing stage focused on email verification, adding another layer of credential harvesting and OTP interception.

See the phishing flow, credential exfiltration chain, and collect IOCs: https://app.any.run/tasks/57a49b17-1d88-458c-9f16-005fd9837fee/

Even with constant domain rotation, the campaign keeps reusing the same phishing-page images, endpoint structure, and multi-step authentication flow. These repeating artifacts make the activity trackable across newly deployed phishing sites.

Hunt for related phishing infrastructure using recurring campaign artifacts in TI Lookup: (url:"/chc.png" AND url:"/member-fdic.svg" AND url:"/equal-housing-lender.svg" AND url:"/image.png")%2522,%2522dateRange%2522:180%7D)

Celebrate ANYRUN’s 10th anniversary with us! Explore special offers: https://app.any.run/plans/