U.S. authorities extradited a Russian national accused of running a bank-account takeover scheme that used lookalike bank domains and paid search ads to trick victims into logging in to fake banking sites. The crew allegedly harvested thousands of banking credentials and then attempted large unauthorized transfers from victim accounts.
This scheme relied on a simple but effective combination: lookalike bank domains paired with paid search advertising. Attackers registered spoofed domains resembling real bank websites, then purchased sponsored links so those domains appeared prominently when victims searched for their bank's login page. Victims who clicked the sponsored result landed on a fraudulent login page designed to closely mimic the real bank site.
Once a victim entered their username and password, the fraudulent site reportedly prompted them for additional details, framed as necessary to bypass security controls. This extra step likely helped attackers work around multi-factor authentication or other protections banks had in place. Prosecutors allege the group collected more than 5,000 victim bank login credentials this way, then attempted unauthorized transfers totaling millions of dollars from two banks.
The attack succeeded because it exploited trust in search engines rather than trust in email or phone calls. Employees with online banking access, including finance, accounting, treasury, and executive staff, may not scrutinize a sponsored search result the way they would an unsolicited email. A slightly altered domain name is easy to miss when the page layout and branding look convincing.
Organizations should train employees with banking access to reach bank portals only through trusted bookmarks or manually typed URLs, treating sponsored search results with skepticism. Staff should learn to verify the exact domain before entering credentials, since lookalike domains are the core of this technique. Finally, any unusual request for additional information during login should trigger a pause and verification through a known, trusted channel rather than immediate compliance.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They allegedly registered spoofed domains that resembled real bank websites and purchased sponsored search links so the fake pages appeared near the top of search results.
Prosecutors allege the group collected more than 5,000 victim bank login credentials and then attempted large unauthorized transfers totaling millions of dollars from two banks.
The fraudulent sites reportedly prompted victims for additional details, framed as needed to bypass security controls, which helped attackers get past extra authentication steps.
Access bank portals only through trusted bookmarks or typed URLs, be cautious of sponsored search results, and verify the exact domain before entering any login credentials.
You Google your bank, click the top result, log in… and someone else just got your banking password. That’s the scam U.S. prosecutors just described: spoofed bank domains plus paid search ads, harvesting thousands of real bank logins and trying to move millions out. The trap: you arrive from a sponsored link, the domain is just a little off, and the site suddenly wants extra details to 'get past security', that’s how they bypass protections. One move: never reach your bank through ads. Use a bookmark or type the exact address, and if a site asks for unusual extra info, close it and start over from your trusted link.
Microsoft disrupted “EvilTokens,” a subscription cybercrime service that stole Microsoft account access using device-code phishing and then used AI-style automation to rapidly mine victims’ inboxes for payment and org-chart details. The goal was to quickly craft believable payment-fraud messages…
Microsoft says it disrupted the “EvilTokens” phishing-as-a-service platform, which it links to compromises of over 12,000 inboxes across more than 10,000 organizations. The service used AI to tailor phishing emails to a victim’s role and to analyze compromised inboxes to identify trusted…
Microsoft reports that the EvilTokens phishing-as-a-service platform helped criminals compromise thousands of organizations by tricking users into completing a legitimate Microsoft “device code” login. The lure drives victims to enter a short code at microsoft.com/devicelogin, which unknowingly…
The bulletin describes real-world social engineering where staff were tricked into disclosing sensitive data or access. In one case, Revolut employees responded to fraudulent information requests sent from a real government-domain email account, exposing extensive customer records. Separately,…
A SecurityWeek roundup highlights multiple real-world scams and campaigns where attackers trick people rather than “hack” systems directly. Notable items include OAuth “consent phishing” (getting users to approve a malicious app’s access), and phishing-evasion using invisible Unicode characters…
A threat landscape report describes how criminals now buy or rent phishing, fraud, malware, and hidden infrastructure “as a service,” making scams faster to launch and harder to stop. The article highlights practical, repeatable social-engineering workflows such as fake CAPTCHA pages that trick…
