Researchers observed phishing sites that appear “dead” to security scanners but turn into convincing fake bank login pages when a victim arrives from poisoned Google/Bing search results. The goal is to steal banking credentials while keeping the malicious pages online for days or weeks by showing different content based on referrer information.
Attackers used SEO poisoning to push fake banking pages to the top of Google and Bing results for high-intent searches like "Bank Name Customer Portal" or "Credit Card Login." Instead of compromising a real bank's domain, they registered new typosquat domains, including unusual second-level domain variants such as .ph.com and .gr.com, and built the fake pages there. The core trick is what researchers call presentation control: the server decides what content to show based on how the visitor arrived. Someone typing the domain directly, with no search engine referrer, sees a dead, offline-looking page. Someone clicking through from the poisoned search result instead lands on a convincing fake bank login page designed to capture credentials.
This referrer-based cloaking is effective because it targets the exact moment a victim is most likely to trust the page, right after clicking a top-ranked search result for their own bank. It also defeats casual verification. A direct visit, the kind a security analyst or automated scanner would typically perform, shows nothing suspicious, which lets the poisoned search results stay active for days or weeks before being flagged and removed. The combination of high search ranking and inconsistent content makes the sites look legitimate to both users and standard security sweeps.
This attack pattern relies on techniques like phishing via search engines (T1598), user execution through a malicious link (T1204.001), and impersonation to steal credentials (T1656, T1566.002).
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They use presentation control, a referrer-based cloaking technique that shows a dead, offline-looking page to direct visitors or scanners, but serves a convincing fake login page only to users who arrive via a poisoned search result.
No, the key findings note the fake banking sites are typically newly registered typosquat domains, including unusual second-level domain variants like .ph.com and .gr.com, rather than compromised legitimate domains.
Skip the search bar for banking logins and instead use a saved bookmark or the bank's official app, since attackers rank these pages for high-intent search terms like customer portal or credit card login.
Treat referrer spoofing and browser emulation as standard steps when testing a reported URL, since a direct visit alone no longer reliably shows what a real victim would see.
You Google “Bank Name Customer Portal,” click the top result… and hand your bank password to a fake site. Attackers use SEO poisoning so their brand‑new typosquat domains on .ph.com or .gr.com outrank the real bank. From search, you see a perfect‑looking login. Type that same URL in directly, and it looks dead or offline. Here’s the nasty trick: this “presentation control” hides phishing from scanners, so poisoned search results stay up for days or weeks, quietly catching anyone who searches for “Credit Card Login” instead of using a bookmark or app. Your move: never search for your bank login. Use a bookmark or the official banking app, every time.
A new Android malware family called “Manic” is being used in real campaigns targeting banking, government identity, and messaging apps, especially in Ukraine and parts of Europe. It spreads through phishing sites and “dropper” apps disguised as legitimate utilities (including a booking-app lure),…
This weekly roundup highlights multiple real-world social engineering threats, including fake IT help-desk phone calls that push employees to phishing sites to steal passwords and one-time authentication codes. It also describes credential-phishing sites impersonating WhatsApp and Instagram that…
A phone-first extortion campaign targeted dozens of major U.S. financial firms by calling employees and posing as corporate help-desk staff. Victims were pushed to “update” passkeys/MFA and sent to fake login pages; attackers captured passwords and MFA codes in real time to take over accounts and…
A criminal group tracked as UNC6671 called employees while pretending to be their company IT helpdesk, creating urgency around “mandatory” security changes. Victims were directed to lookalike login pages to “enable passkeys” or “update MFA,” allowing attackers to steal passwords and capture…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
A ransom-focused hacking group targeted major U.S. financial and other firms by calling employees on their personal phones while impersonating the company help desk. Victims were pushed to “update passkeys or multifactor authentication” and sent to look‑alike websites designed to steal passwords…
