Summary

More than 200 sites were seen serving phishing content to first-time visitors but not to those who revisit. A threat actor has been relying on fake ‘suspended account’ notices to hide phishing content from users revisiting its look-alike bank websites, cybersecurity firm Kela reports. The campaign, active since May, has been relying on more than 300 fake domains, including 248 impersonating 189 US financial institutions. The first were registered in late 2025, but most of them appeared between July and September 2026.

AI summaries can be wrong sometimes—always verify important details using the source article.