Reported by 2 outlets

Timeline

1. original reporting

   Hackers Use Chameleon SEO Poisoning to Hide Banking Phishing Pages From Security Scanners

   cyberpress.org · 50d ago · August 24th, 2026

   Threat researchers at Fortra Intelligence and Research Experts (FIRE) have documented a more than 40% surge in a novel evasion technique dubbed “Chameleon SEO Poisoning,” which allows phishing operators to rank malicious pages at the top of search results while remaining completely invisible to automated security scanners. Unlike traditional phishing, which relies on mass email or SMS “push” campaigns, Chameleon attacks use a “pull” strategy letting search engines drive victims directly to fraudulent pages. Chameleon SEO Poisoning Hides Banking Phishing Pages Attackers register typo-squatted domains on private second-level domains (SLDs) such as .ph.com and .gr.com , then invest heavily in SEO manipulation to rank these pages above legitimate results for high-intent queries like “Bank Name Customer Portal” or “Credit Card Login,” expanding the threat surface alongside active credential harvesting operations . Parked Landing Page Served to Direct Visitors and Scanners (Image Source: fortra.com) The core of the technique is cloaking based on HTTP referrer headers, creating what researchers call “Presentation Control.” Direct visits from security crawlers, threat intel bots, or users typing the URL trigger the server to return a dead or 404 page, making the domain appear abandoned to reputation services and registrars. Conversely, search referrals visits where the referrer header confirms a click from Google or Bing trigger deployment of a pixel-perfect banking portal clone desi

2. update from gbhackers.com

   Google and Bing Search Results Used to Deliver Hidden Banking Phishing Pages

   gbhackers.com · 50d ago · August 24th, 2026

   Threat actors are increasingly using Google and Bing as phishing delivery channels, employing a cloaking technique that presents harmless pages to security scanners while serving credential-harvesting banking portals to genuine search users. The campaigns target users of major financial institutions and combine search-engine optimization abuse, recently registered lookalike domains, and referral-aware payload delivery to extend […] The post Google and Bing Search Results Used to Deliver Hidden Banking Phishing Pages appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .