Hackers Use Chameleon SEO Poisoning to Hide Banking Phishing Pages From Security Scanners
Brief
Threat researchers at Fortra Intelligence and Research Experts (FIRE) have documented a more than 40% surge in a novel evasion technique dubbed “Chameleon SEO Poisoning,” which allows phishing operators to rank malicious pages at the top of search results while remaining completely invisible to automated security scanners.
Unlike traditional phishing, which relies on mass email or SMS “push” campaigns, Chameleon attacks use a “pull” strategy letting search engines drive victims directly to fraudulent pages.
Chameleon SEO Poisoning Hides Banking Phishing Pages
Attackers register typo-squatted domains on private second-level domains (SLDs) such as . ph. com and . gr.