According to Kela, as reported by SecurityWeek, the campaign has been active since May and uses more than 300 domains, 248 of them impersonating 189 US financial institutions, mainly mid-sized regional banks. As of October 25, 183 of the targeted institutions still had live look-alikes, and 49 new domains appeared in the past week, some imitating help-desk and live-chat pages of JPMorgan, Citi, BMO and Santander. The campaign mainly targets business banking and treasury logins and also hits victims in the UK, Australia and New Zealand.
The phishing kit remembers each visitor's IP address. A first-time visitor sees a branded bank login page, while a returning visitor sees a notice mimicking a hosting provider's closed-account page. As a result, a security team or takedown provider re-checking a reported site may mark it as removed while it keeps serving new victims. Kela has not yet determined how victims are lured to the sites.
Advice for organizations and security teams: sign in to bank accounts only through a manually typed address or the official app, and re-check suspicious sites from a new IP address before marking them as taken down.