Loading story…
Fortra disclosed a phishing campaign dubbed Chameleon SEO Poisoning that manipulates Google and Bing results to steer users searching for financial services to fraudulent banking login pages. The operation uses recently registered typosquat and lookalike domains, including private second-level domain patterns such as .ph.com and .gr.com, to impersonate major financial institutions and capture customer credentials. Fortra’s FIRE team said it tracked the activity for three months and observed a 40% increase in cases during Q2 2026.
The campaign relies on cloaking and server-side presentation control to evade detection: users arriving from poisoned search results are shown convincing bank portals, while direct visitors, automated scanners, registrars, and hosting providers may see inactive or benign pages instead. Researchers said the tactic shifts phishing away from email and SMS toward search-driven victim acquisition at the moment users intend to log in, and urged defenders to test suspicious URLs with referrer spoofing and browser emulation, monitor branded search rankings and newly registered lookalike domains, and accelerate takedowns tied to suspicious second-level domain abuse.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Fortra disclosed Chameleon SEO Poisoning as a phishing method that poisons search results and uses cloaked fake banking websites to evade scanners and steal credentials. The company said the infrastructure commonly used recently registered typosquat domains on second-level domains such as .ph.com and .gr.com.
Fortra reported a 40% increase in Chameleon SEO Poisoning cases during the second quarter of 2026. The campaign targeted major financial institutions and users searching for banking login pages through Google and Bing.
Fortra's FIRE team tracked a phishing technique it calls Chameleon SEO Poisoning over a three-month period. The activity used SEO-manipulated search results, lookalike domains, and cloaked fake banking pages to steal credentials.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortra reported a **40% increase** in cloaked “Chameleon” SEO-poisoning campaigns during the second quarter of 2026. The activity targets major financial institutions and their customers by using high-intent banking search terms to push phishing pages into prominent Google and Bing results, while showing benign content to automated scanners and other inspection systems. The campaigns use newly registered, typosquatted second-level domains rather than compromised legitimate websites, making fraudulent pages appear relevant to users seeking banking services. Organizations should warn customers and employees to reach financial portals through official mobile applications or manually saved bookmarks, rather than search-engine results, and monitor for typosquatted domains impersonating their brands.
Sep 1, 2026
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026Attackers are leveraging SEO poisoning by creating keyword-stuffed, cloaked doorway pages that rank highly in search results. These pages instantly redirect users to fraudulent sites, often for phishing, malware delivery, or selling counterfeit goods. The technique exploits search engine algorithms and user trust, making detection and proactive threat hunting essential.
Jun 29, 2026