Hackers Use Chameleon SEO Poisoning to Hide Banking Phishing Pages From Security Scanners

Fortra Intelligence and Research Experts (FIRE) describe a surge in “Chameleon SEO Poisoning,” a phishing evasion technique that ranks typo-squatted domains in search results and cloaks payloads based on HTTP referrer headers so scanners see inert/parked pages while search-referred visitors receive pixel-perfect banking clones; the report outlines attacker infrastructure, detection evasion, and practical mitigation steps for SOCs, registrars, and CISOs.