Chameleon SEO Poisoning: Banking Phishing Risk

## Executive summary Chameleon SEO Poisoning is an active campaign identified by Fortra's FIRE team that manipulates Google and Bing search results and uses cloaking with typo-squatted or private second-level domains (e.g., .ph.com, .gr.com) to present convincing fake banking login pages to users arriving via search; observed activity increased by more than 40% in Q2 2026 and the report provides IoC patterns, tactical breakdown, and defensive recommendations such as using official apps/bookmarks, enabling MFA, monitoring lookalike domains, and performing context-aware URL testing.