Fake Bank Phishing Network Uses Self-Suspension Trick to Evade Takedowns, 248 Domains Live
KELA researchers uncovered an active financial-scam infrastructure, dubbed the "Suspended" infrastructure operation, running hundreds of cloned banking websites that fake their own suspension to evade detection and takedown. As of October 25, 2026, 248 live phishing/scam domains tied to 189 major US banks and financial services firms have been linked to the campaign, with over 300 domains hosted on the same infrastructure since May 2026. The scheme targets business banking customers using a [keyword]-[bank].com naming pattern with words like "secure," "disable," "protect," and "cancel." The campaign remains active, with new domains appearing daily, and one unverified lead points to a UK home broadband connection used to remotely access the infrastructure.
Detalhes técnicos
The phishing kit logs the IP address of each visitor and, on a victim's second visit, displays a fake "account suspended" page styled to resemble legitimate Cloudflare challenge pages, tricking scanners and security teams into believing the site was already taken down while real victims (on their first visit) still see the cloned banking site and are lured into entering credentials. Other decoys observed include "Sorry, you've been blocked" messages, blank pages, redirects to Google, reCAPTCHAs, and anti-analysis scripts that block browser developer tools.
Remediação
KELA recommends using phishing link checkers to verify URLs, treating unsolicited bank communications with suspicion, watching for unusual sender addresses, poor formatting, emotionally manipulative content, and suspicious links/attachments, and calling the bank directly (not via numbers in the suspicious message) to verify legitimacy. KELA has released a free Bank Phishing Check tool allowing organizations to compare their official domains against the uncovered scam infrastructure.
Linha do tempo
-
Fake Bank Phishing Network Uses Self-Suspension Trick to Evade Takedowns, 248 Domains Live
ler a análise desta fonte ocultar
KELA researchers uncovered an active financial-scam infrastructure, dubbed the "Suspended" infrastructure operation, running hundreds of cloned banking websites that fake their own suspension to evade detection and takedown. As of October 25, 2026, 248 live phishing/scam domains tied to 189 major US banks and financial services firms have been linked to the campaign, with over 300 domains hosted on the same infrastructure since May 2026. The scheme targets business banking customers using a [keyword]-[bank].com naming pattern with words like "secure," "disable," "protect," and "cancel." The campaign remains active, with new domains appearing daily, and one unverified lead points to a UK home broadband connection used to remotely access the infrastructure.
Technical Details
The phishing kit logs the IP address of each visitor and, on a victim's second visit, displays a fake "account suspended" page styled to resemble legitimate Cloudflare challenge pages, tricking scanners and security teams into believing the site was already taken down while real victims (on their first visit) still see the cloned banking site and are lured into entering credentials. Other decoys observed include "Sorry, you've been blocked" messages, blank pages, redirects to Google, reCAPTCHAs, and anti-analysis scripts that block browser developer tools.
Remediation
KELA recommends using phishing link checkers to verify URLs, treating unsolicited bank communications with suspicion, watching for unusual sender addresses, poor formatting, emotionally manipulative content, and suspicious links/attachments, and calling the bank directly (not via numbers in the suspicious message) to verify legitimacy. KELA has released a free Bank Phishing Check tool allowing organizations to compare their official domains against the uncovered scam infrastructure.