A phishing campaign is using more than 300 look-alike banking domains to steal business banking and treasury login credentials. First-time visitors see a convincing bank login page, but anyone returning from the same IP address sees a fake “account suspended” notice, making the sites appear to have been taken down.
This campaign relies on more than 300 look-alike domains, including 248 impersonating 189 US financial institutions, to harvest business banking and treasury credentials. Domain names follow a repeatable pattern, pairing banking terms such as secure, protect, or commercial with a targeted bank's name. Newer variants use help-desk, live-support, treasury-portal, and primary-device themes to appear more legitimate.
The core trick is IP-based cloaking. A first-time visitor sees a branded login page requesting a user ID and password, sometimes with a reCAPTCHA. The browser tab is titled Attention required, copying the look of a Cloudflare challenge page, and a script blocks developer tools to hinder inspection. Anyone who revisits the same page from the same IP address instead sees a fake account-suspension notice styled to look like a hosting provider shut the site down.
The suspension-page trick directly undermines the normal verification process used by security teams and takedown providers. When a scanner or analyst checks a reported domain, confirms it looks malicious, and then checks again to verify, the second check can return what appears to be a completed takedown. This can cause legitimate phishing infrastructure to be deprioritized or marked resolved while it continues collecting credentials from new victims. The branding accuracy, reCAPTCHA, and Cloudflare-style tab title also add a veneer of legitimacy that can delay suspicion from a typical business banking user.
Organizations can reduce exposure by training treasury, finance, and accounts payable staff to access banking portals only through bookmarks or known official URLs, never through links in email or search results. Security and fraud teams should avoid assuming a reported site is inactive simply because a repeat check shows a suspension page, and should instead verify from a fresh IP address or controlled environment before closing an investigation. Because this campaign focuses on business banking rather than personal accounts, awareness programs should emphasize immediate reporting of suspicious banking login prompts across treasury and finance teams specifically.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The phishing kit records the IP address of each visitor. First-time visitors see a branded bank login page, but anyone who returns from the same IP address is instead shown a fake hosting-account suspension notice, making the site look like it was already taken down.
The campaign primarily targets business banking and treasury login accounts at mid-sized regional banks, with victims also identified in the UK, Australia, and New Zealand.
Look for look-alike domains combining words like secure, protect, commercial, help-desk, or treasury-portal with a bank's name, a browser tab titled Attention required mimicking a Cloudflare challenge, and unexpected requests for business banking credentials.
Because the site may serve a fake suspension page only to repeat visitors from the same IP, a scanner or takedown provider rechecking from the same network can mistakenly conclude the phishing page is already down while it is still live for new visitors.
That treasury login might vanish when you check it twice. First visit: a convincing bank page asks for your business user ID and password, maybe with reCAPTCHA. The tab says ‘Attention required.’ Come back from the same network? ‘This account has been suspended.’ That’s the trick: the site remembers your IP. Suspended doesn’t mean safe. See ‘secure,’ ‘help-desk,’ or ‘treasury-portal’ added to a bank name? Open your approved banking bookmark instead.
Threat actors sent fake invitations to an exclusive Anthropic AI preview to steal Google and Microsoft work credentials. The campaign abused trusted services, including GoTo Webinar and a URL shortener, then used CAPTCHA pages and convincing fake login screens to make detection harder. Employees…
Attackers are taking over hotel and conference Wi‑Fi gateways and changing DNS settings so travelers are silently redirected to fake Microsoft 365 sign-in pages. Victims are then tricked into completing a device-code login that grants attackers a legitimate session token, often bypassing MFA. This…
Researchers uncovered an active banking-phishing operation using hundreds of cloned financial websites. The sites show real victims a fake bank login page, but display a convincing “account suspended” notice to security scanners on a second visit, helping the criminals avoid takedown action. The…
Microsoft and partners disrupted three "phishing-as-a-service" kits that enabled criminals to send more than a billion phishing emails and SMS messages worldwide. The kits provided ready-made fake brand pages (government, finance, logistics, consumer brands) designed to steal login credentials and…
Microsoft reports disrupting a Chinese-language “phishing-as-a-service” ecosystem that sold phishing kits and “legitimate-looking” cloud infrastructure to criminals worldwide. The operation enabled large-scale email and SMS phishing that impersonated trusted brands (government, delivery,…
Microsoft and Health-ISAC disrupted a Chinese-language phishing marketplace ecosystem (YAM Store, CoGUI, and Iron Man) that enabled criminals to send over a billion malicious messages globally. The services sold phishing kits, compromised accounts, and infrastructure, and were frequently used to…
