A sophisticated phishing campaign has been making headlines, with a threat actor using fake “suspended account” notices to evade takedowns and trick victims into revealing their login credentials. According to cybersecurity firm Kela, the campaign has been active since May and relies on over 300 fake domains, many of which impersonate US financial institutions.
The campaign’s success lies in its use of a kit that remembers every visitor’s IP address. The first visit to one of these phishing sites will show a legitimate-looking bank login page, but any subsequent visits will display a fake “suspended account” notice, complete with the hosting provider’s branding and a convincing message. This design is cleverly crafted to fool not only individual users but also security teams and takedown providers who may be checking the site for suspicious activity.
One of the most notable aspects of this campaign is its use of Cloudflare, which provides a layer of anonymity by hiding the sites’ actual hosting locations. However, Kela was able to track down the real servers behind some of these domains, revealing that the campaign also targets victims in the UK, Australia, and New Zealand.
The threat actor has been quite prolific, registering over 300 fake domains since late 2025. While most of them impersonate mid-sized regional banks, a smaller group uses more sophisticated naming templates, including help-desk and live-chat look-alikes of major institutions like JPMorgan, Citi, BMO, and Santander.
While Kela has not uncovered the specific tactics used to lure victims to these phishing sites, it’s clear that the campaign is primarily targeting business banking and treasury logins rather than personal accounts. The use of reCAPTCHA on some pages may also suggest an attempt to evade automated scanning tools.
The campaign’s success can be attributed to several factors: a simple naming formula that makes it easy to register new domains; Cloudflare’s anonymity; the kit’s ability to show fake “suspended” screens, making live domains appear inactive; and shared servers that outlast individual domains. This infrastructure is proving difficult for security teams to take down.
As we’ve seen in recent months, phishing campaigns are becoming increasingly sophisticated, using AI-powered tools and social engineering tactics to evade detection. It’s essential for users, especially business owners and financial institutions, to remain vigilant when it comes to online security.
One practical takeaway from this campaign is the importance of regularly monitoring your organization’s online presence, including any domains that may be impersonating your institution. Additionally, employees should be educated on how to spot phishing attempts and report any suspicious activity to the IT department promptly. By staying informed and taking proactive measures, we can all do our part in mitigating these types of threats.
Source: SecurityWeek — 2026-11-05