This article was written by an AI agent working under human supervision; the human it works for verified and approved it before publication.
An open directory on a domain impersonating the US FDIC turned out to host not one but two separate credential-harvesting phishing kits, targeting two unrelated regional US financial institutions. Both kits mirror the bank’s real online-banking login page pixel-for-pixel, run the exact same anti-bot engine, and — most tellingly — both carry the identical hardcoded seller/license signature. This isn’t two operators independently building lookalike pages. It’s one buyer running two brand variants of the same commercial kit.
The lure: a double login, then an OTP prompt
The funnel is deliberately simple and effective. A victim lands on a page that is, for all practical purposes, the bank’s real login screen — because large parts of it are: CSS, JavaScript bundles, and even the FDIC compliance-logo image are pulled live from the bank’s actual production CDN at render time, not re-hosted by the kit. Only the form’s submit action has been swapped out.
After entering credentials, the victim is shown a second, identical copy of the same login form. This “double-capture” trick is a small but deliberate design choice: it doubles the odds that at least one of the two submitted credential pairs is typo-free, and it fits naturally into how a real bank site sometimes behaves after a session hiccup, so it rarely raises suspicion. A one-time-passcode entry page follows, harvesting the victim’s 2FA code too. A fake “success” page then waits six seconds before quietly redirecting the victim to the bank’s actual website — so their last impression is an ordinary, successful login.
Every field captured — username, password, OTP code — is exfiltrated immediately and directly to a Telegram bot, along with the victim’s IP address and browser fingerprint.
An anti-bot layer more sophisticated than the phishing page itself
What stood out in this kit wasn’t the lure — it’s a fairly standard credential phish — but the defensive engineering wrapped around it. Before a visitor ever sees a login form, a battery of checks runs: headless-browser (WebDriver) detection, a battery-API probe used specifically to filter out laptops, a VR-display API repurposed to detect virtual machines and remote-desktop sessions, DoNotTrack and cookie-support checks, hosting-ASN IP filtering, Tor and blank-user-agent blocking, and a call out to an external fraud-scoring API that evaluates all of the above before deciding whether to show the real page or bounce the visitor to Google. A decoy sitemap.xml pointing only at an innocuous “under construction” page rounds out the camouflage, aimed squarely at automated scanners and casual manual review rather than the intended human victims.
One seller, two banks, and a stray leftover asset
Both kit copies hardcode the identical Telegram bot token and chat ID, and both carry the exact same license string in their configuration — explicitly commented in the source as the place to put “YOUR USERNAME” — strongly suggesting this is a purchased or licensed kit template, with the buyer’s handle baked in by the seller at delivery time. Every backend file — the anti-bot engine, the exfiltration logic, the settings schema — is byte-identical between the two brand deployments; only the mirrored bank-specific pages differ.
One small forensic detail: the kit impersonating one regional bank still carries a leftover logo and script bundle branded for an entirely different, unrelated major bank in one of its asset folders — a trace of whatever scraping tool or shared asset cache the kit builder used previously, not fully cleaned before this copy was repackaged and delivered.
As of this writing, neither kit had captured any real victim data — both the blocked-bot log and the passed-visitor log were empty, consistent with the delivery domain having been registered less than a day before we found it.
Indicators of Compromise
All network indicators below are defanged (. → [.]) so they cannot be clicked. Operator credentials (Telegram bot token, license handle) are reproduced in full, as these belong to the attacker’s own infrastructure. No victim data exists in this snapshot — both kit logs were empty.
Delivery host (confirmed live via urlscan.io, 2026-09-18):
fdichelpsupport[.]com - registered 2026-09-17, open directory listing 138.197.128.232 - hosting IP
Attacker exfiltration credentials (operator’s own, reproduced in full):
Telegram bot token : 8587481198:AAGcMw91hPAL3p2ssgIyRUDiY-fRDExatLM Telegram chat ID : 5000006602 Kit license handle : @psyco_m Operator fallback email : yba.boss@aol.com (channel disabled)
Anti-bot / traffic-filtering infrastructure:
hxxps://bestwaytohelpyourfamilyandself[.]com/GDG/index.php - external fraud-scoring API (NXDOMAIN at check time) activateyourscampage[.]com - shared anti-bot bounce/challenge domain (live, registered 2021)
Mirrored real infrastructure (not itself malicious — legitimate service abused as a source of authentic-looking assets):
cdn1.onlineaccess1[.]com - real Q2 Software "Tecton" online-banking CDN, mirrored by both kits
Recommendations
- Never trust a login page’s visual authenticity as proof it’s genuine — this kit demonstrates that even CSS, scripts, and compliance logos can be pulled live from a bank’s real infrastructure while the page itself is fully fraudulent.
- If a login form appears twice in a row without explanation, treat it as a red flag rather than a glitch, and verify you’re on the bank’s real domain before re-entering credentials.
- The identified Telegram channel is a candidate for abuse reporting; the delivery domain is a candidate for registrar abuse reporting.
- Financial institutions should monitor for kits mirroring their production online-banking CDN assets, since these kits are visually indistinguishable from the real login flow to a casual user.
—
Written by an AI agent; verified and approved by the human it works for.
Emiliano Carlesi's blog 