Researchers found more than 800 “phantom” online banking sites built from a cheap, reused website template and designed to look like legitimate financial institutions. These portals appear to support scams where a fraudster (e.g., a “broker” or “loan agent”) directs victims to log in, register, and share sensitive data in a convincing fake banking interface. One site’s sloppy copy-paste error revealed a separate domain where registration data would be sent.
Researchers identified roughly 2,200 domains sharing the phrase "one of the largest digital banking providers," with 838 still displaying that phrase and functioning. Most of these sites, 97 percent, retained parts of a $25 banking and currency-exchange website template, and 94 percent used the same backend components for login, registration, and session handling. This let fraud operators stand up hundreds of near-identical fake bank portals cheaply and quickly.
The scam pattern behind these sites follows a familiar structure. A broker, romantic contact, loan agent, recovery service, or supposed delivery representative introduces a victim to an unfamiliar financial institution. The phantom portal then gives that fabricated story a persistent interface for accounts, balances, investment gains, transfers, holds, and withdrawal problems, making the scam feel more real and giving the victim a reason to keep engaging.
The sites relied on what researchers called legitimacy stacking: dashboards, product pages, corporate details, and support contacts layered together to make an invented institution appear credible. Most sites went further than a static landing page, with 770 including login pages, 767 setting session cookies, and 729 including anti-forgery tokens, all signs the operators intended to actually collect and retain submitted data rather than just display a convincing front.
One site, branded as Classtands Crest, made a copy-paste error that exposed how these operations connect. Its account-creation page was still titled "Create an Account- Remedy bank" in the source code, and the registration form was set to send submitted data to a separate domain, remedycodes[.]site, tying multiple suspected-fraud sites together.
Treat any request to register or log into an unfamiliar bank portal, especially one introduced by a third party, as a major warning sign, and verify the institution independently before entering any information. Encourage finance, support, and fraud teams to look for inconsistencies like mismatched branding and low-quality template errors, and to correlate multiple signals, such as shared code, matching cookies, and where forms actually send data, rather than relying on any single indicator when investigating a suspected fake banking site.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They are fake online banking portals, over 800 identified in this research, built from a cheap reused website template to look like legitimate financial institutions and collect user data.
Researchers found around 2,200 domains sharing a specific phrase, one of the largest digital banking providers, and traced hundreds of active sites still containing template artifacts and login flows.
A broker, romantic contact, loan agent, recovery service, or delivery representative introduces a victim to an unfamiliar financial institution, then directs them to log in or register on the fake portal to reinforce the scam story.
Watch for typos like the misspelled heading, mismatched page titles or branding, registration forms that submit data to unrelated domains, and unfamiliar banks introduced by third parties.
Imagine a broker sends you a link to “one of the largest digital banking providers” you’ve never heard of. Researchers found over 800 of these phantom banks, all built from the same $25 “Cuex” template, stacked with fake dashboards, balances, and support pages to make invented banks look real. Here’s the giveaway: one site called Classtands Crest still showed a page title “Create an Account- Remedy bank,” and its registration form quietly sent your details to another domain, remedycodes[.]site. If any third party sends you to an unfamiliar bank portal, stop. Don’t register or log in until you independently verify the bank using your own search and known-good contact details.
Attackers abused access to a third-party email newsletter provider to send convincing “security alert” emails from legitimate-looking crypto company domains. The emails pushed users to click links that led to phishing sites designed to look nearly identical to real platforms. Trezor, CoinTracking,…
U.S. authorities extradited a Russian national accused of running a bank-account takeover scheme that used lookalike bank domains and paid search ads to trick victims into logging in to fake banking sites. The crew allegedly harvested thousands of banking credentials and then attempted large…
Microsoft reported a real, high-volume phishing campaign (up to millions of emails per day) that hid key “loan/funding” lure words using invisible Unicode characters to slip past email filters. The emails used disposable finance-themed domains and were often routed through ActiveCampaign…
Mandiant and Google report that the financially motivated group BREEZE COMET compromised Brazilian organizations to enable fraudulent bank transfers. The actor used human manipulation (including fake IT support calls) and believable “tax/receipt” downloads hosted on trusted-looking government…
Apollo Global Management disclosed a data breach after attackers used social engineering to gain unauthorized access to certain cloud platforms over several days in July. The attackers obtained sensitive personal data (including Social Security numbers), highlighting how stolen credentials and…
Researchers described a real phishing campaign using a platform called “ZeroTokens” that lets a live operator watch what a victim types and change the next phishing prompts in real time. The lure used “W-8BEN tax-documentation reviews” and spoofed financial institutions’ multi-step verification…
