Threat Actors Poison Search Engine Results, Leading Victims to Concealed Banking Phishing Pages

Bank customers searching online for their financial institution's login page may be exposed to phishing attacks before receiving the traditional lure of a malicious email or text message.

Cybercriminals are increasingly abusing Google and Bing search rankings to place fraudulent banking websites in front of users seeking legitimate online banking services. This campaign, known as Chameleon SEO Poisoning, transforms routine searches for terms such as "bank login," "customer portal," or "credit card account access" into opportunities for credential theft.

Users who click on these high-ranking malicious search results may be directed to convincing replicas of legitimate banking websites designed to harvest credentials and capture active user sessions.

Researchers from Fortra's Intelligence and Research Experts (FIRE) observed a significant increase in this activity during the second quarter of 2026. According to the researchers, multiple major financial institutions and their customers were targeted by the campaign.

Fortra reported that the phishing infrastructure is deliberately engineered to appear benign during standard security inspections, delaying detection and takedown efforts. This allows threat actors additional time to collect credentials and compromise customer accounts.

SEO Poisoning Becomes a Banking Threat

The campaign leverages search engine optimization (SEO) poisoning, a technique used to elevate attacker-controlled websites in search results for high-value keywords. Rather than compromising legitimate websites, attackers register lookalike domains and optimize their content around common banking-related search terms.

Unlike traditional phishing campaigns that rely on unsolicited emails or SMS messages, this approach targets users precisely when they are actively searching for their bank's login page.

The technique mirrors previous campaigns in which threat actors successfully positioned fake software download pages near the top of search engine results, demonstrating how search rankings can be weaponized as an effective distribution channel for phishing and malware operations.

Cloaking Technology Evades Detection

A key element of the Chameleon campaign is the use of cloaking, a technique that presents different content depending on who is visiting the website.

When security researchers, automated scanners, domain registrars, or hosting providers visit the malicious URL directly, the site may appear inactive or generate a fake "404 Not Found" error. However, the same URL can display a highly convincing banking login page when the visitor arrives through a Google or Bing search result.

This selective content delivery enables attackers to remain undetected for extended periods while continuing to target legitimate users. As a result, security teams may incorrectly classify reported phishing domains as harmless, even while customers are actively being redirected to credential theft pages.

Why Traditional Detection Methods Fail

Many reputation services and automated security tools analyze websites outside of their original browsing context. Without the expected search referral information, Chameleon-operated sites often serve benign content, misleading defenders into believing the site is safe.

Researchers recommend that security teams evaluate suspicious search results under conditions that closely mirror the victim experience. This includes using consumer browser profiles, preserving search referral data, and testing from geographic regions relevant to the targeted bank's customer base.

The objective is to observe exactly what an end user would see rather than relying solely on automated scans.

Security teams should also monitor newly registered lookalike domains and investigate unusual top-ranking search results associated with banking brands and financial services.

Recommendations for Organizations and Consumers

The campaign highlights a growing trend in which search engine trust is being exploited to facilitate phishing attacks. Similar tactics have previously been used to distribute malware and redirect users to fraudulent software downloads by making small changes to domain names and creating convincing landing pages.

For consumers, security experts recommend accessing banking services through official mobile applications or trusted bookmarks rather than relying on search engine results. This simple practice significantly reduces exposure to deceptive websites designed to imitate trusted financial brands.

Organizations, meanwhile, should view search visibility as part of their overall attack surface rather than solely a marketing concern. Enhanced monitoring of brand-related search results, faster validation of cloaked phishing evidence, and closer scrutiny of newly registered domains can help identify malicious campaigns before they affect large numbers of customers.

Key Takeaway

The appearance of a website at the top of a search engine results page should not be considered proof of legitimacy. As threat actors continue to exploit user trust in search engines, banks, security teams, and consumers must carefully verify the path used to access financial services. Increasingly, phishing attacks are hiding in plain sight behind the credibility of trusted search platforms.

Note: IP addresses and domains referenced in threat intelligence reports are often intentionally defanged (for example, replacing "." with "[.]") to prevent accidental access. Indicators should only be re-fanged and investigated within controlled security environments such as SIEM platforms, MISP, or VirusTotal.