ACTIVE CAMPAIGN

Researchers at Squeaky Flotilla have come across a spattering of nearly-identical phishing sites configured to appear as the homepage to a bank, complete with

• an informational pages,
• a contact link, and (most importantly)
• an account creation link which prompts the user to enter their most personal information

Initial links were found on PhishTank.org, a Cisco Talos-operated public database of potential and active phishing links that is regularly updated. After encountering the first such site

we came across another,

and another,

and a couple more

… and another few :(

Following the initial PhishTank-sourced sites, we noticed that the sites consistently used the phrase

"We do banking differently. We believe that people come first, and that everyone deserves a great experience every step of the way – whether it’s face to face, over the phone, online or on our app." </blockquote> on their home page; as such, a Google Dork of this phrase revealed the majority of these malicious sites to us. Their insistence of not being like the other banks earned the phishing kit its name: DifferentBank :)

---