Crooks bank on Microsoft’s search engine to phish customers

Malwarebytes reports an active phishing campaign that manipulates Microsoft Bing search results to display fraudulent KeyBank login pages. Attackers registered domains (e.g., ixx-kexxx.com) and used cloaking to present benign pages to crawlers while redirecting real users to HTTPS phishing portals that harvest credentials, security questions, and MFA codes; the report includes multiple phishing domains and a hosting IP and recommends stronger authentication methods (passkeys or authenticator apps).