Fake bank websites play dead to evade security scanners

Fortra’s FIRE unit uncovered "Chameleon SEO Poisoning," a phishing campaign using typo‑squat domains and SEO poisoning to surface fake bank login pages in search results; attackers cloak content based on the search referrer so scanners see benign pages while search-click victims receive convincing credential-stealing forms. FIRE tracked the technique for three months, reported a 40% rise in Q2 2026, and issued role-specific recommendations for detection and takedown.