Researchers found more than 800 “phantom” online banking sites built from a cheap, reused website template and designed to look like legitimate financial institutions. These portals appear to support scams where a fraudster (e.g., a “broker” or “loan agent”) directs victims to log in, register, and share sensitive data in a convincing fake banking interface. One site’s sloppy copy-paste error revealed a separate domain where registration data would be sent.
Researchers identified roughly 2,200 domains sharing the phrase "one of the largest digital banking providers," with 838 still displaying that phrase and functioning. Most of these sites, 97 percent, retained parts of a $25 banking and currency-exchange website template, and 94 percent used the same backend components for login, registration, and session handling. This let fraud operators stand up hundreds of near-identical fake bank portals cheaply and quickly.
The scam pattern behind these sites follows a familiar structure. A broker, romantic contact, loan agent, recovery service, or supposed delivery representative introduces a victim to an unfamiliar financial institution. The phantom portal then gives that fabricated story a persistent interface for accounts, balances, investment gains, transfers, holds, and withdrawal problems, making the scam feel more real and giving the victim a reason to keep engaging.
The sites relied on what researchers called legitimacy stacking: dashboards, product pages, corporate details, and support contacts layered together to make an invented institution appear credible. Most sites went further than a static landing page, with 770 including login pages, 767 setting session cookies, and 729 including anti-forgery tokens, all signs the operators intended to actually collect and retain submitted data rather than just display a convincing front.
One site, branded as Classtands Crest, made a copy-paste error that exposed how these operations connect. Its account-creation page was still titled "Create an Account- Remedy bank" in the source code, and the registration form was set to send submitted data to a separate domain, remedycodes[.]site, tying multiple suspected-fraud sites together.
Treat any request to register or log into an unfamiliar bank portal, especially one introduced by a third party, as a major warning sign, and verify the institution independently before entering any information. Encourage finance, support, and fraud teams to look for inconsistencies like mismatched branding and low-quality template errors, and to correlate multiple signals, such as shared code, matching cookies, and where forms actually send data, rather than relying on any single indicator when investigating a suspected fake banking site.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They are fake online banking portals, over 800 identified in this research, built from a cheap reused website template to look like legitimate financial institutions and collect user data.
Researchers found around 2,200 domains sharing a specific phrase, one of the largest digital banking providers, and traced hundreds of active sites still containing template artifacts and login flows.
A broker, romantic contact, loan agent, recovery service, or delivery representative introduces a victim to an unfamiliar financial institution, then directs them to log in or register on the fake portal to reinforce the scam story.
Watch for typos like the misspelled heading, mismatched page titles or branding, registration forms that submit data to unrelated domains, and unfamiliar banks introduced by third parties.
Imagine a broker sends you a link to “one of the largest digital banking providers” you’ve never heard of. Researchers found over 800 of these phantom banks, all built from the same $25 “Cuex” template, stacked with fake dashboards, balances, and support pages to make invented banks look real. Here’s the giveaway: one site called Classtands Crest still showed a page title “Create an Account- Remedy bank,” and its registration form quietly sent your details to another domain, remedycodes[.]site. If any third party sends you to an unfamiliar bank portal, stop. Don’t register or log in until you independently verify the bank using your own search and known-good contact details.
Researchers found dozens of lookalike websites impersonating real crypto projects and promising a small, believable reward boost if users “vote” on a rewards distribution date. The vote is fake; clicking “Vote now” triggers a wallet connection prompt and can lead to malicious approval/signature…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
Criminals in parts of Europe have been mailing fake “replacement” bank cards or letters claiming a card is expiring, pushing victims to scan a QR code or visit a URL to “activate” the card. The QR code redirects to a fake banking site that harvests login and account details, potentially giving…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Microsoft disrupted “EvilTokens,” a subscription cybercrime service that stole Microsoft account access using device-code phishing and then used AI-style automation to rapidly mine victims’ inboxes for payment and org-chart details. The goal was to quickly craft believable payment-fraud messages…
Microsoft says it disrupted the “EvilTokens” phishing-as-a-service platform, which it links to compromises of over 12,000 inboxes across more than 10,000 organizations. The service used AI to tailor phishing emails to a victim’s role and to analyze compromised inboxes to identify trusted…
