Researchers observed phishing sites that appear “dead” to security scanners but turn into convincing fake bank login pages when a victim arrives from poisoned Google/Bing search results. The goal is to steal banking credentials while keeping the malicious pages online for days or weeks by showing different content based on referrer information.
Attackers used SEO poisoning to push fake banking pages to the top of Google and Bing results for high-intent searches like "Bank Name Customer Portal" or "Credit Card Login." Instead of compromising a real bank's domain, they registered new typosquat domains, including unusual second-level domain variants such as .ph.com and .gr.com, and built the fake pages there. The core trick is what researchers call presentation control: the server decides what content to show based on how the visitor arrived. Someone typing the domain directly, with no search engine referrer, sees a dead, offline-looking page. Someone clicking through from the poisoned search result instead lands on a convincing fake bank login page designed to capture credentials.
This referrer-based cloaking is effective because it targets the exact moment a victim is most likely to trust the page, right after clicking a top-ranked search result for their own bank. It also defeats casual verification. A direct visit, the kind a security analyst or automated scanner would typically perform, shows nothing suspicious, which lets the poisoned search results stay active for days or weeks before being flagged and removed. The combination of high search ranking and inconsistent content makes the sites look legitimate to both users and standard security sweeps.
This attack pattern relies on techniques like phishing via search engines (T1598), user execution through a malicious link (T1204.001), and impersonation to steal credentials (T1656, T1566.002).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They use presentation control, a referrer-based cloaking technique that shows a dead, offline-looking page to direct visitors or scanners, but serves a convincing fake login page only to users who arrive via a poisoned search result.
No, the key findings note the fake banking sites are typically newly registered typosquat domains, including unusual second-level domain variants like .ph.com and .gr.com, rather than compromised legitimate domains.
Skip the search bar for banking logins and instead use a saved bookmark or the bank's official app, since attackers rank these pages for high-intent search terms like customer portal or credit card login.
Treat referrer spoofing and browser emulation as standard steps when testing a reported URL, since a direct visit alone no longer reliably shows what a real victim would see.
You Google “Bank Name Customer Portal,” click the top result… and hand your bank password to a fake site. Attackers use SEO poisoning so their brand‑new typosquat domains on .ph.com or .gr.com outrank the real bank. From search, you see a perfect‑looking login. Type that same URL in directly, and it looks dead or offline. Here’s the nasty trick: this “presentation control” hides phishing from scanners, so poisoned search results stay up for days or weeks, quietly catching anyone who searches for “Credit Card Login” instead of using a bookmark or app. Your move: never search for your bank login. Use a bookmark or the official banking app, every time.
Microsoft observed a ClickFix campaign where compromised websites cache a hidden payload in the victim’s browser, then trick the user into pasting a command (often via Win+R) that executes what’s already on the device. The method helps attackers hide the payload and get around Windows “Run”…
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
This bulletin describes multiple real-world scams where attackers make fake pages and messages look like routine, trusted experiences (search answers, Google login pop-ups, “giveaways,” and official-sounding calls). Examples include a fake Claude Max giveaway using a convincing fake Google sign-in…
Microsoft reported a real, high-volume phishing campaign (up to millions of emails per day) that hid key “loan/funding” lure words using invisible Unicode characters to slip past email filters. The emails used disposable finance-themed domains and were often routed through ActiveCampaign…
Apollo Global Management disclosed a data breach after attackers used social engineering to gain unauthorized access to certain cloud platforms over several days in July. The attackers obtained sensitive personal data (including Social Security numbers), highlighting how stolen credentials and…
Researchers documented a real phishing method where attackers push fake bank sites up in search results, then show different content depending on how a person arrived. If someone clicks from a poisoned search result, the site shows a realistic bank login page to steal credentials; if security teams…
