InfoSecBulletin Cybersecurity for mankind
Bank customers looking for a login page can now fall into a trap before getting a strange email or text. Hackers are changing Google and Bing results so fake banking pages show up where people think they will find real services.
The Chameleon SEO Poisoning campaign turns regular searches for things like bank customer portals or credit card logins into chances for phishing. The campaigns aim at users of big banks and mix tricks to improve search rankings, new fake website domains, and smart ways to deliver phishing pages to keep them active longer.
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
Chameleon campaigns are different from regular phishing scams. Instead of sending bad links by email or text, they use a method that pulls in victims. Attackers change search results to place fake sites at the top for important searches like “Bank Name Customer Portal,” “Credit Card Login,” or other account access phrases.
Victims looking for a financial service might find a harmful link that shows up above or near the real banking site.
The domains controlled by attackers are usually typo-squats. These are found on new second-level domains like .ph.com and .gr.com, instead of being real websites that were hacked.
This method makes search visibility a way to access accounts. A user’s trust in a known search engine and the need to reach an account helps the operator a lot. Fortra Intelligence and Research Experts (FIRE) reported that “Chameleon SEO Poisoning” activity rose by more than 40% in Q2 2026.
Google and Bing Search Results
Chameleon SEO Poisoning is all about controlling what is shown. The same URL gives different information based on how the visitor gets there.
When a researcher, web host, reputation service, or automated sandbox checks the suspicious domain directly, the server might show an offline page, a generic error, or a fake 404 message. This can make the domain seem inactive and may lead analysts to wrongly ignore an alert as a false positive.
When a request shows that a visitor came from Google or Bing, the site delivers its active content. This usually includes a very realistic copy of a banking login page made to steal login details, session cookies, or other authentication information.
Fortra Intelligence and Research Experts (FIRE) warned that these campaigns can facilitate credential theft and session hijacking while remaining active longer than traditional phishing infrastructure. The method tricks the victim as they browse. The bad search result is the bait, and going directly to the site hides the trap.
Most systems that check domain reputation and URL scanners look at a site by sending a direct request. This way is not good for a campaign that checks the requester first. A scanner with a regular user agent, a data-center IP address, or no search link might get the clean page.
The harmful website can still look safe. This happens even when banking customers find it through search results and see a site that steals their login info. Fortra suggests that SOC teams should go beyond static scans and mimic victim situations.
Investigations should check relevant search-engine sources, current browser types, and where allowed, geographic profiles that match the targeted institution’s customers. CISOs now change how they protect their brand. They move from reacting to problems to constantly checking search results for brand, login, and support terms.
Top results that seem unusual, especially those using new lookalike domains, should be seen as a serious warning for fraud. FIRE has shown how SEO-poisoning services use fake links and hacked sites to boost fake financial pages. This highlights how big and developed this system is.
SOC playbooks should also say not to close a suspicious-URL case just because a direct visit shows an offline page. Analysts need evidence that takes context into account. This includes the referrer, user agent, redirect chain, content shown, and location response actions.
Related News:
Google Search Results Reportedly Show Claude AI Shared Chats
