Phishing campaign uses fake suspended notices to hide malicious banking domains

A phishing campaign targeting financial institutions is using fake suspended account notices to hide malicious content from security researchers and returning users, according to SecurityWeek. Cybersecurity firm Kela reported that the operation has been active since May 2026. The attackers deploy these notices to visitors who revisit the look-alike bank domains, while displaying phishing pages to first-time visitors. [3]

SecurityWeek reported that the infrastructure involves more than 300 fake domains. Out of these, 248 domains impersonated 189 financial institutions in the United States. Registration of the initial domains began in late 2025, with the majority appearing between July and September 2026. SecurityWeek noted that 183 of the targeted organizations were still affected as of October 25. [3]

The tactic of manipulating site responses to avoid security scanning builds on earlier evasion strategies used by online attackers. As FTMQ Security reported earlier, threat groups have previously used techniques such as oversized payload files in GitHub repositories or pre-fetched scripts in browser caches to bypass automated detection systems. [3][8][9]

The technique allows phishing operators to delay takedown efforts by convincing researchers that the malicious sites are offline. Security teams are advised to monitor for newly registered domains that mimic official banking portals and to test suspect URLs using clean, unvisited environments. [3]