US Bank Phishing Scam Exposed by KELA Researchers

A sophisticated banking scam has been exposed by KELA researchers, who have uncovered an extensive network of fraudulent websites designed to evade detection. These sites are capable of mimicking their own suspensions in order to remain online and continue their malicious activities.

The infrastructure behind the scam hosts hundreds of fake websites that clone the official domains of major US banks and financial services. The "Suspended operation has been linked to 248 such domains, with many using a specific format, [keyword]-[bank].com, where keywords like secure," "disable," and "protect are inserted in place of legitimate words.

The scam's focus is on business banking, suggesting that it targets companies rather than individual consumers. This could be due to the fact that businesses often have larger financial transactions and may be more vulnerable to phishing attacks.

The infrastructure behind the scam appears to be run by a handful of servers hosted across two shared hosting providers, with ties to phishing campaigns targeting cryptocurrency exchanges and government services in various countries including the UK, Netherlands, Australia, and New Zealand.

The cybercriminals behind this phishing campaign have devised an innovative tactic to evade detection: issuing takedown notices themselves. This unusual move appears to be a deliberate attempt to avoid being flagged and taken down by law enforcement agencies or technology firms.

When a website is shut down due to malicious activity, visitors typically see a notice indicating that the domain has been suspended or taken offline. However, in this case, the scam artists have created their own fake suspension notices, effectively taking control of the narrative. This clever ploy allows them to masquerade as legitimate authorities, further deceiving unsuspecting victims.

The fake account suspended" page is designed to look deceptively simple and innocuous at first glance. However, upon closer inspection, it's clear that this page is actually a phishing kit in disguise. The kit registers the IP address of each visitor on their second visit, providing valuable intelligence for the scammers.

This sophisticated ruse also includes a challenge page similar to those used by Cloudflare, further confusing and misleading security teams and scanners who may be monitoring the domain. By employing this tactic, the cybercriminals are able to stay one step ahead of their pursuers, at least for now.

The cybercriminals' tactics have taken a creative turn as they employ decoy measures to evade detection. These include fake suspension notices, blank pages, and redirections to Google, which are designed to deceive both scanners and cybersecurity teams.

Some of these decoys even feature reCAPTCHAs, adding an extra layer of complexity for researchers trying to analyze the malicious domain. Furthermore, scripts have been detected that block browser developer tools, likely intended to slow down the analysis process and hinder investigators' efforts.

The purpose behind displaying fake suspension notices is to create a false sense of security among scanners and cybersecurity teams. By making it appear as though someone else has already dealt with the malicious domain, the cybercriminals aim to divert attention away from their own activities.

As a result, victims continue to see the cloned website, complete with enticing lures designed to trick them into entering sensitive information, ultimately leading to financial fraud and potential identity theft. This tactic allows the attackers to stay under the radar, at least for now.

The phishing campaign remains active despite researchers disclosing their findings to law enforcement, with over 300 scam domains hosted on the same infrastructure since May this year. In addition to these, there are currently 248 live domains in operation, and new ones continue to emerge every day.

One potential lead in uncovering the identity of the operator has been identified: a remote desktop connection was detected from a standard UK home broadband connection to the malicious infrastructure, but it remains unverified at this time. This lack of confirmation highlights the challenges faced by researchers in tracking down the individuals behind such complex scams.

To protect oneself from these phishing attempts, users can employ various tools and strategies, including using a phishing link checker to verify the trustworthiness of URLs, as well as being cautious when receiving emails or messages claiming to be from their bank.