Fake bank websites play dead to evade security scanners
Fortra uncovered Chameleon SEO Poisoning: cloaked typosquat bank sites rank on Google and Bing to steal credentials while evading scanners, with cases up 40% in Q2 2026.
Fortra's threat intelligence unit FIRE spent three months tracking Chameleon SEO Poisoning, a phishing method that ranks recently registered typosquat domains on second-level domains like .ph.com and .gr.com above legitimate bank sites on Google and Bing. The technique uses presentation control (cloaking by referrer): direct visits get a dead, offline-looking page, while search-referred clicks receive a convincing fake bank login page, letting poisoned results persist for days or weeks. Fortra recorded a 40% jump in cases during the second quarter of 2026 and recommends referrer-spoofed URL testing, faster SLD takedowns, and bookmarking bank logins.
- Typosquat domains on SLDs like .ph.com and .gr.com outrank legitimate bank sites via SEO poisoning.
- Cloaking serves a dead page to direct visitors but a fake login to search-referred clicks.
- Fortra recorded a 40% increase in cases during Q2 2026 after three months of tracking.
- Recommendations include referrer-spoofed testing, faster SLD takedowns, and bookmarking bank logins.
- Organizations
- Fortra Intelligence and Research Experts
From the original article
1 min read at helpnetsecurity.com
A phishing method, named Chameleon SEO Poisoning, that uses manipulated search results and cloaked fake banking websites to steal credentials while evading security scanners has been discovered by Fortra. The company’s threat intelligence unit, Fortra Intelligence and Research Experts (FIRE), spent three months tracking the technique and reports a 40% jump in cases during the second quarter of 2026.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.