Phishing Campaign Actively Targets Customers of 300 US Banks with Evasion Tactics
A sophisticated phishing campaign, active since May, is targeting customers of approximately 300 U.S. financial institutions and cryptocurrency exchanges, employing novel evasion techniques to thwart detection.
A widespread phishing campaign, operational since May, has been actively targeting customers of around 300 U.S. banks, cryptocurrency exchanges, and even U.S. Department of the Treasury government services. Threat intelligence firm Kela reported that as of late October, 248 malicious domains impersonating 189 American financial services firms remained active, out of over 300 identified in total. The majority of these domains were constructed using patterns like keyword-bank.com, with keywords frequently including terms such as 'secure,' 'disable,' 'protect,' and 'cancel,' aiming to appear legitimate.
The campaign's primary objective is to trick victims into divulging their account login credentials, which are then used to facilitate fraudulent wire and automated clearing house (ACH) transfers. While the exact number of individuals who have fallen victim remains unknown, the scale of the operation suggests a significant potential for financial loss. The attackers are employing a variety of common phishing tactics, including fake login pages, but have incorporated a sophisticated method to evade security scanners and takedown efforts.
A key innovation in this campaign is its ability to detect and respond to security scrutiny. If a security scanner or a researcher revisits a phishing page from the same IP address, the page will resolve to a fake "account suspended" message, a blocked page, or a redirect to a Google search. This tactic is designed to make live malicious domains appear dead to automated scanners and human investigators, thereby prolonging the campaign's lifespan and hindering takedown operations.
Researchers noted that this appears to be the first public detailing of this specific campaign, and they have found no evidence of a particular phishing kit being used, suggesting a custom-built operation. While individual domains may have appeared on phishing blocklists, they were not previously linked together as part of a coordinated effort. The repeat-visit trick itself is not entirely new, but its application at this scale against U.S. banks, particularly their business banking customers, and its effectiveness against takedown checks, are notable.
Kela has launched a free Bank Phishing Check tool to help financial institutions assess if their websites are being impersonated. The firm has shared its findings with law enforcement and intelligence agencies and followed responsible disclosure practices by notifying affected institutions. The campaign has demonstrated adaptability, switching hosting providers in September, and has been observed using the same infrastructure for attacks targeting banks, crypto exchanges, and government services in the UK, Netherlands, Australia, and New Zealand.
While the non-U.S. lures use different branding and target consumer-facing brands, suggesting separate campaigns, the shared infrastructure points towards a single operator or a phishing-as-a-service platform. The U.S. bank-targeting attacks utilize a two-layer infrastructure, with phishing sites masked by Cloudflare, and backend hosting services temporarily revealed during "brief gaps in Cloudflare's cover." This setup includes separate backend and management servers, accessed via SSH through a jump server, which also connects to Telegram servers, indicating the potential use of automated bots for remote administration.
The attackers have shown a pattern of migrating their operations between hosting providers, first using one from May and switching to another in September. Both providers host numerous unrelated websites and other phishing operations, further obscuring the malicious activity. The campaign's persistence and its sophisticated evasion techniques highlight the evolving nature of cybercrime targeting the financial sector.