Fake bank websites play dead to evade security scanners

1. Executive summary

Fortra's threat intelligence unit (FIRE) has documented a phishing technique dubbed "Chameleon SEO Poisoning" that uses SEO-poisoned search results and cloaked typosquat domains to serve fake banking login pages while evading security scanner detection. The technique exploits "presentation control" — serving different content based on the HTTP referrer — so that direct visits (including automated security sweeps) see a dead, offline-looking page, while clicks arriving from poisoned search engine results receive a convincing credential-harvesting page. FIRE reports a 40% increase in cases during Q2 2026. EMEA financial services are directly in the crosshairs: attackers target high-intent brand keywords ("Bank Name Customer Portal", "Credit Card Login") and register typosquats on second-level domains (SLDs) such as .ph.com and .gr.com, meaning retail and corporate banking customers across the region are at elevated risk of credential theft.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The technique targets end-customers via external typosquat domains and search engine manipulation rather than compromising the financial institution's own ICT systems or third-party providers. While individual credential-theft incidents could escalate into major ICT-related incidents if they lead to account compromise and fraud, the phishing technique itself does not trigger a distinctive obligation under the articles in scope that would change what a client must do beyond standard phishing preparedness.

3. Technical analysis & attack chain

Attribution caveat: No named threat actor is identified in the source material. Attribution is unconfirmed; the technique is described as a method observed across multiple cases rather than attributed to a specific group.

Attack chain (confirmed steps from Fortra/FIRE reporting)

1. Domain registration — typosquatting on SLDs. Attackers register typosquat domains on second-level domains such as .ph.com and .gr.com (e.g., bankname[.]ph[.]com). These are not compromised legitimate domains; they are newly registered typosquats designed to visually approximate the target bank's domain.
2. SEO poisoning. Attackers manipulate search engine rankings on Google and Bing to place their typosquat pages above the legitimate bank site for high-intent keywords such as "Bank Name Customer Portal" and "Credit Card Login."
3. Presentation control / referrer-based cloaking. The malicious server inspects the HTTP Referer header of incoming traffic. This is the core evasion mechanism: - No referrer / direct navigation / automated scanner: The server returns a dead, offline-looking page — no phishing content, no malicious artefacts. This defeats URL scanners, security sweeps, and manual investigations that visit the URL directly. - Referrer from search engine (Google/Bing) via poisoned result click: The server returns a convincing fake bank login page designed to harvest credentials.
4. Credential capture. The victim, having clicked through from a search result believing the page to be legitimate, enters banking credentials into the fake login form.
5. Sustained evasion. Because security scanners see only the dead page, the poisoned search results remain active for days or weeks before detection and takedown.

Key technical detail: The cloaking decision is based on the Referer header. Fortra explicitly demonstrated that the same typosquat domain served a dead page when typed manually (no referrer) and a full fake bank login page when accessed via a search engine click (with referrer). This means any URL reputation system that fetches URLs without a search-engine referrer will classify the domain as benign.

Single-sourced caveat: All technical detail in this advisory is sourced from a single vendor report (Fortra/FIRE via Help Net Security). The 40% Q2 2026 increase figure and the specific SLD patterns (.ph.com, .gr.com) are single-sourced; verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Update phishing investigation procedures. Security teams must treat referrer spoofing and browser emulation as standard steps when investigating a reported phishing URL. A direct visit is no longer reliable evidence of a page's nature. Specifically:
• When analysing a suspected phishing URL, replay the request with a Referer header set to https://www.google.com/ and https://www.bing.com/ to trigger the cloaked phishing content.
• Use curl or a scriptable browser (e.g., Playwright, Selenium) to fetch the URL with and without a search-engine referrer and diff the responses.
• Example: curl -s -H "Referer: https://www.google.com/" https://suspected-domain[.]tld/ | diff - <(curl -s https://suspected-domain[.]tld/)
• Alert SOC/CSIRT teams that a clean direct-visit scan does NOT rule out a cloaked phishing site.

P2 — Within 72 hours

• Monitor brand keyword search rankings. CISOs and brand-protection teams should monitor Google and Bing search results for high-intent brand keywords (e.g., "[Bank Name] login", "[Bank Name] customer portal", "[Bank Name] credit card login") and flag any result pointing to a domain the organisation does not own. This can be automated with scheduled search-rank monitoring tools.
• Block typosquat SLD patterns at the web proxy / DNS firewall. Add rules to block or flag traffic to known-bank typosquats on SLDs such as .ph.com and .gr.com where the second-level label matches the bank brand. Coordinate with your DNS filtering vendor for feed coverage.
• Submit takedown requests with referrer-triggered evidence. When reporting cloaked domains to hosting providers and registrars, include screenshots/captures of both the dead page (direct visit) and the phishing page (referrer-triggered visit) to demonstrate the cloaking behaviour. Fortra advises registrars to accept referrer-triggered evidence as grounds for takedown.

P3 — Within 7 days

• Customer communication. Advise retail and corporate banking customers to bookmark the official login URL or use the bank's official mobile app rather than navigating via search engines. This eliminates the SEO poisoning entry point entirely.
• Review email/web security gateway configuration to ensure that URL categorisation and re-analysis pipelines include referrer-based content variation testing, not just single-fetch scanning.

5. Indicators of compromise

No atomic indicators of compromise (domains, IPs, hashes, URLs) are available in the source material. The source describes the technique and SLD patterns but does not publish specific malicious domains or infrastructure IOCs.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source material describes the cloaking technique and behavioural patterns but does not provide specific strings, filenames, page content, HTTP response signatures, or other artefacts that could populate a YARA or Sigma rule. The behavioural indicators in §5 should be operationalised as procedural checks in the phishing investigation workflow rather than as static detection rules.

7. Sources

• Help Net Security, "Fake bank websites play dead to evade security scanners," https://www.helpnetsecurity.com/2026/08/24/chameleon-seo-poisoning-fake-banking-websites-phishing/, 2026-08-24

8. Adverse Trace position

This is a credible and operationally significant evolution in phishing evasion that directly targets EMEA financial services customers. The referrer-based cloaking technique is technically simple but effective: it exploits a blind spot in most URL scanners and manual investigation workflows, which fetch URLs without search-engine referrer headers. The 40% Q2 2026 increase reported by Fortra suggests the method is gaining traction among threat actors. Severity is assessed as medium-high for EMEA financial services — not because of system compromise, but because of the sustained window for credential theft (days to weeks), the targeting of high-intent banking keywords, and the erosion of trust in search-engine navigation as a customer access path. Attribution is unconfirmed; no specific actor is named. All technical detail is single-sourced from Fortra/FIRE. Adverse Trace will monitor for published IOCs (specific typosquat domains, hosting infrastructure) and update clients as corroboration emerges. Clients should immediately update phishing investigation runbooks to include referrer-spoofed URL fetches and begin brand-keyword search-rank monitoring.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.