Kela reports bank phishing kit shows fake suspended pages on revisit

What happened

According to SecurityWeek, citing the cybersecurity firm Kela, a threat actor is using fake “suspended account” notices to hide phishing content from people who revisit its look-alike bank sites. SecurityWeek reports that Kela says the campaign has been active since May and relies on more than 300 fake domains, including 248 that impersonate 189 US financial institutions. SecurityWeek says Kela found the first domains were registered in late 2025, with most appearing between July and September 2026.

Kela says the kit remembers each visitor’s IP address. A first visit gets a bank login page with the bank’s branding, a user ID and password prompt, and possibly a reCAPTCHA. A return visit gets a page that copies a hosting provider’s closed-account notice. Kela calls this cluster the “Suspended” infrastructure. In Kela’s words, as quoted by SecurityWeek, a takedown provider can mark a look-alike domain as down while it is still serving the phishing page to new visitors.

Other details Kela reportedly gave, per SecurityWeek:

• As of October 25, 183 of the targeted organizations still had live look-alikes, mainly mid-sized regional banks. Kela says 49 new domains appeared the previous week.
• Many domains pair a keyword such as secure, disable, protect, cancel, authorize, terminate, credentials or commercial with a hyphen and the bank’s name. A smaller, growing group uses help-desk, live-support, treasury-portal and “primary device” names.
• Kela says the campaign largely targets business banking and treasury logins rather than personal accounts, and also targets victims in the UK, Australia and New Zealand.
• Some domains showed other fake notices or redirected to Google, which Kela says prevents public scanning services from capturing the full campaign.
• The domains sit behind Cloudflare, but some briefly resolved to their real servers, which let Kela trace their hosting.

Not confirmed: how victims are lured to the pages (SecurityWeek says Kela has not discovered this), the number of victims, any losses, and who is behind the campaign. This is one outlet’s report of one vendor’s research, with no independent verification in the sources.

Am I affected?

The sources do not describe any software flaw or patch, and no CVE is cited. Per SecurityWeek’s account of Kela’s findings, the groups most relevant are:

• Customers of US financial institutions, especially mid-sized regional banks, and business banking or treasury users. Kela also reports targeting in the UK, Australia and New Zealand.
• Brand protection, security and takedown teams at banks, and takedown providers, who may re-check a reported domain and see a suspended page.

Kela’s reported examples include help-desk and live-chat look-alikes of JPMorgan, Citi, BMO and Santander. The sources do not say these banks were breached.

What to do now

1. If you verify reported phishing domains, re-check each one from a new IP address. Kela says seeing the live content requires a new IP for every check, and that a second check from the same address shows what looks like a completed takedown.
2. Do not close a case on a “This account has been suspended” page alone. Per Kela, a live domain can pass for an inactive one.
3. Review domains for the naming pattern Kela describes: a keyword such as secure, disable, protect, cancel, authorize, terminate, credentials or commercial, then a hyphen, then the bank’s name. Also check help-desk, live-support and treasury-portal variants.
4. Remember that public scanners may not see the full campaign. Kela says some domains redirect to Google or show other fake notices.
5. Editorial note, not from the sources: business banking users who are unsure about a link can reach their bank through the address they already use rather than a message link.

Sources

• SecurityWeek: Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns