Researchers found more than 800 “phantom” online banking sites built from a cheap, reused website template and designed to look like legitimate financial institutions. These portals appear to support scams where a fraudster (e.g., a “broker” or “loan agent”) directs victims to log in, register, and share sensitive data in a convincing fake banking interface. One site’s sloppy copy-paste error revealed a separate domain where registration data would be sent.
Researchers identified roughly 2,200 domains sharing the phrase "one of the largest digital banking providers," with 838 still displaying that phrase and functioning. Most of these sites, 97 percent, retained parts of a $25 banking and currency-exchange website template, and 94 percent used the same backend components for login, registration, and session handling. This let fraud operators stand up hundreds of near-identical fake bank portals cheaply and quickly.
The scam pattern behind these sites follows a familiar structure. A broker, romantic contact, loan agent, recovery service, or supposed delivery representative introduces a victim to an unfamiliar financial institution. The phantom portal then gives that fabricated story a persistent interface for accounts, balances, investment gains, transfers, holds, and withdrawal problems, making the scam feel more real and giving the victim a reason to keep engaging.
The sites relied on what researchers called legitimacy stacking: dashboards, product pages, corporate details, and support contacts layered together to make an invented institution appear credible. Most sites went further than a static landing page, with 770 including login pages, 767 setting session cookies, and 729 including anti-forgery tokens, all signs the operators intended to actually collect and retain submitted data rather than just display a convincing front.
One site, branded as Classtands Crest, made a copy-paste error that exposed how these operations connect. Its account-creation page was still titled "Create an Account- Remedy bank" in the source code, and the registration form was set to send submitted data to a separate domain, remedycodes[.]site, tying multiple suspected-fraud sites together.
Treat any request to register or log into an unfamiliar bank portal, especially one introduced by a third party, as a major warning sign, and verify the institution independently before entering any information. Encourage finance, support, and fraud teams to look for inconsistencies like mismatched branding and low-quality template errors, and to correlate multiple signals, such as shared code, matching cookies, and where forms actually send data, rather than relying on any single indicator when investigating a suspected fake banking site.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They are fake online banking portals, over 800 identified in this research, built from a cheap reused website template to look like legitimate financial institutions and collect user data.
Researchers found around 2,200 domains sharing a specific phrase, one of the largest digital banking providers, and traced hundreds of active sites still containing template artifacts and login flows.
A broker, romantic contact, loan agent, recovery service, or delivery representative introduces a victim to an unfamiliar financial institution, then directs them to log in or register on the fake portal to reinforce the scam story.
Watch for typos like the misspelled heading, mismatched page titles or branding, registration forms that submit data to unrelated domains, and unfamiliar banks introduced by third parties.
Imagine a broker sends you a link to “one of the largest digital banking providers” you’ve never heard of. Researchers found over 800 of these phantom banks, all built from the same $25 “Cuex” template, stacked with fake dashboards, balances, and support pages to make invented banks look real. Here’s the giveaway: one site called Classtands Crest still showed a page title “Create an Account- Remedy bank,” and its registration form quietly sent your details to another domain, remedycodes[.]site. If any third party sends you to an unfamiliar bank portal, stop. Don’t register or log in until you independently verify the bank using your own search and known-good contact details.
A new Android malware family called “Manic” is being used in real campaigns targeting banking, government identity, and messaging apps, especially in Ukraine and parts of Europe. It spreads through phishing sites and “dropper” apps disguised as legitimate utilities (including a booking-app lure),…
This weekly roundup highlights multiple real-world social engineering threats, including fake IT help-desk phone calls that push employees to phishing sites to steal passwords and one-time authentication codes. It also describes credential-phishing sites impersonating WhatsApp and Instagram that…
Researchers found a turnkey scam kit sold on a cybercrime forum that lets criminals quickly stand up a fake crypto “presale” website styled to look like Tesla. The site uses pressure tactics and a fake investment dashboard to trick people into either handing over their wallet recovery phrase or…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
A phone-first extortion campaign targeted dozens of major U.S. financial firms by calling employees and posing as corporate help-desk staff. Victims were pushed to “update” passkeys/MFA and sent to fake login pages; attackers captured passwords and MFA codes in real time to take over accounts and…
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
