Active phishing campaign targets customers of 300 US banks

A ongoing phishing campaign has targeted customers of 300 different United States banks and financial services firms since May, BankInfoSecurity reported. The threat intelligence firm Kela stated in a report that the operation primarily targets midsize and regional institutions. The targets also include global cryptocurrency exchanges and users of United States Department of the Treasury government services. [1]

BankInfoSecurity reported that fraudsters are attempting to deceive financial services customers into revealing account login details. The ultimate goal of the campaign is to steal funds, including through wire transfers and automated clearing house transfers. Kela observed 24 active elements of the campaign as of October 25. [1]

As FTMQ Security reported earlier, the phishing operator displays fake suspended account notices to returning visitors to hide malicious domains from detection and automated takedown efforts. The broader operation involves more than 300 fake domains, with most of the malicious web addresses registered between July and September 2026. [5]

FTMQ Security previously reported that 248 of the fake domains targeted 189 financial institutions in the United States. As of October 25, 183 targeted organizations were still affected by the ongoing campaign. [5]