Trusted Platforms Exploited to Steal Philippine Banking Credentials

This report describes an ongoing, sophisticated phishing campaign against Philippine bank customers that leverages trusted services and compromised domains to host convincing fake banking pages; researchers observed over 900 malicious links and more than 400 victims, with stolen credentials and OTPs exfiltrated via automated Telegram bots to enable rapid fraud. The operation uses hotlinking of real bank assets, short-lived SSL certificates, rotating subdomains, and compromised sender accounts to evade detection and improve email deliverability, and defenders are advised to improve monitoring, email filtering, and user awareness.