Bank phishing sites show fake 'suspended' pages to evade takedowns

According to Kela, a threat actor uses fake “account suspended” notices to hide phishing content from repeat visitors to look-alike bank websites. The campaign has been active since May and involves more than 300 fake domains, including 248 impersonating 189 US financial institutions. It primarily targets business banking and treasury logins; domains have also been traced to victims in the UK, Australia, and New Zealand.