Loading story…
Fortra reported a 40% increase in cloaked “Chameleon” SEO-poisoning campaigns during the second quarter of 2026. The activity targets major financial institutions and their customers by using high-intent banking search terms to push phishing pages into prominent Google and Bing results, while showing benign content to automated scanners and other inspection systems.
The campaigns use newly registered, typosquatted second-level domains rather than compromised legitimate websites, making fraudulent pages appear relevant to users seeking banking services. Organizations should warn customers and employees to reach financial portals through official mobile applications or manually saved bookmarks, rather than search-engine results, and monitor for typosquatted domains impersonating their brands.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Fortra reported a 40% increase in cloaked “Chameleon” SEO-poisoning activity during the second quarter of 2026. The campaigns used newly registered typosquatted domains and banking-related search terms to direct users to phishing pages while evading automated scanning.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortra disclosed a phishing campaign dubbed **Chameleon SEO Poisoning** that manipulates Google and Bing results to steer users searching for financial services to fraudulent banking login pages. The operation uses recently registered typosquat and lookalike domains, including private second-level domain patterns such as `.ph.com` and `.gr.com`, to impersonate major financial institutions and capture customer credentials. Fortra’s FIRE team said it tracked the activity for three months and observed a **40% increase** in cases during Q2 2026. The campaign relies on cloaking and server-side presentation control to evade detection: users arriving from poisoned search results are shown convincing bank portals, while direct visitors, automated scanners, registrars, and hosting providers may see inactive or benign pages instead. Researchers said the tactic shifts phishing away from email and SMS toward search-driven victim acquisition at the moment users intend to log in, and urged defenders to test suspicious URLs with referrer spoofing and browser emulation, monitor branded search rankings and newly registered lookalike domains, and accelerate takedowns tied to suspicious second-level domain abuse.
Aug 24, 2026Attackers are leveraging SEO poisoning by creating keyword-stuffed, cloaked doorway pages that rank highly in search results. These pages instantly redirect users to fraudulent sites, often for phishing, malware delivery, or selling counterfeit goods. The technique exploits search engine algorithms and user trust, making detection and proactive threat hunting essential.
Jun 29, 2026
Researchers reported two web-based campaigns that used **indirect prompt injection**, **SEO poisoning**, and hidden HTML or `JSON-LD` content to manipulate autonomous AI agents. In one case, attackers promoted fake documentation for a bogus Python package, `requests-secure-v2`, and embedded concealed instructions telling AI systems to obtain an API key or fix an error by sending cryptocurrency as a supposed developer license fee. Zscaler ThreatLabz said the operation was tied to infrastructure including domains, repositories, an Ethereum wallet, and a GitHub account identified as **Open-Agent-Utilities**. A second campaign used the typosquatted domain `debank[.]auction` to impersonate the DeBank DeFi platform and inserted hidden prompts directing AI agents to treat the fraudulent site as authoritative. In controlled testing with a browsing-capable autonomous agent, Zscaler found that **4 of 26** evaluated LLMs could be induced to make a payment and **2** incorrectly classified the fake DeBank site as trustworthy. The findings show that public web content and search rankings are becoming a practical attack surface as AI agents gain the ability to browse, decide, and execute actions.
Jul 8, 2026