A threat actor has been relying on fake ‘suspended account’ notices to hide phishing content from users revisiting its look-alike bank websites, cybersecurity firm Kela reports.
The campaign, active since May, has been relying on more than 300 fake domains, including 248 impersonating 189 US financial institutions. The first were registered in late 2025, but most of them appeared between July and September 2026.
As of October 25, 183 of the targeted organizations still had live look-alikes, mainly targeting mid-sized regional banks. Last week, 49 new domains appeared.
“What ties them together is one mechanism: the kit remembers every visitor’s IP address, so the first visit gets a bank login page, and any return visit gets what looks like a closed hosting account. We call this cluster the ‘Suspended’ infrastructure,” Kela notes.
Most of the identified domains follow a similar naming pattern containing a keyword such as ‘secure’, ‘disable’, ‘protect’, ‘cancel’, ‘authorize’, ‘terminate’, ‘credentials’, and ‘commercial’ followed by a hyphen and the targeted bank’s name.
“A smaller, growing group uses help-desk, live-support, treasury-portal, and ‘primary device’ names built on the bank’s name. About half of the 49 domains that went live in the week to October 25 use these templates, including help-desk and live-chat look-alikes of JPMorgan, Citi, BMO, and Santander,” Kela notes.
While the cybersecurity firm has not discovered how victims are lured to the phishing pages, it did conclude that the campaign is largely targeting business banking and treasury logins rather than personal accounts.
First-time visitors are served pages that contain the targeted bank’s branding, ask for a user ID and password, and may show a reCAPTCHA.
The tab title, “Attention required”, copies Cloudflare’s challenge page name, while a script on the page blocks the browser’s developer tools.
Users who visit the page again are shown a ‘This account has been suspended’ page that copies the notice a hosting provider shows after an account has been closed.
“That design targets exactly the people who could shut a site down. A victim typically follows a link once. A scanner, a security team, or a takedown provider checks a reported site, then checks it again to confirm, and the second check shows what looks like a completed takedown. In practice, a takedown provider can mark a look-alike domain as down while it is still serving the phishing page to new visitors. Seeing the live content requires a new IP address for every check,” Kela notes.
While the fake suspended page was seen across multiple phishing domains, some of them served other fake notices, while others redirected to Google instead, preventing public scanning services from capturing the full campaign.
The domains sit behind Cloudflare, but some briefly resolved to their real servers, which allowed Kela to trace their actual hosting and to discover that the campaign also targets victims in the UK, Australia, and New Zealand.
“Four things make this infrastructure hard to stop: a naming formula simple enough to repeat for any bank; Cloudflare, which hides where the sites are hosted; a kit that shows anyone checking twice a fake ‘suspended’ screen, so a live domain can pass for an inactive one; and shared servers that outlast any single domain,” Kela notes.
Related: Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
Related: AI-Linked Breaches Mount as WorkOS, Northflank, Trigger.dev Disclose Hacks
Related: AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
Related: Phishing Research Challenges Conventional Security Awareness Testing
