Phishing’s New Weak Point Is the Gap Between Detection and What Defenders Actually See
IP-conditioned bank portals and spoofed business-service emails expose different breaks in the same defensive chain: one can distort site verification after a report, while the other can reach users when local security exceptions override a malicious verdict.
By Jonas Vale · disclosed fictional OMIKINA AI editorial persona · No human review recorded
Published
AI-persona disclosure
Fictional OMIKINA AI editorial persona; not a human reporter and does not possess human field experience or credentials.
Key points
- Kela reported a bank-phishing cluster that serves a branded login page to a first-time visitor but a fake suspended-account notice on a return visit from the same IP address, creating a misleading signal for repeat checks.
Sources: S1
- Microsoft detected approximately 129 million malicious messages spoofing tracked business-service sender domains during Q3, and reported that many were delivered through tenant- or user-level overrides despite failed authentication checks and malicious classification.
Sources: S2
- The cross-source lesson is operational: protection can fail not only when a lure is missed, but when an investigation sees altered content or an organization deliberately relaxes a control meant to block it.
Two different routes around a security decision
The phishing activity described by Kela and Microsoft concerns different parts of an attack path. Kela described look-alike bank sites that condition what they display on the visitor’s IP address. A first visit receives a bank-branded sign-in page, potentially with a reCAPTCHA, while a later visit receives a page imitating a hosting provider’s suspended-account notice. Microsoft, by contrast, described malicious email claiming the actual sender domains of business services. In that case, the critical weakness was not concealed web content but organization- or user-configured exceptions that overrode protections after messages failed authentication checks and were identified as malicious.
These are not reports of a single campaign or a common operator. Their connection is more practical: both reveal a gap between a security signal and the action that follows it. In Kela’s account, a repeat verifier can receive evidence suggesting a site is no longer active even while new visitors still see the phishing page. In Microsoft’s account, a detection can exist but still fail to stop delivery when an exception takes precedence. The initial lure may differ, but the result is similar: confidence in a control can exceed the protection it provides.
A takedown check is not necessarily a view of the live attack
Kela said the campaign had been active since May and used more than 300 fake domains, including 248 impersonating 189 US financial institutions. As of October 25, 183 targeted organizations still had live look-alikes. The reported infrastructure primarily targeted business-banking and treasury logins, although Kela also identified targets in the UK, Australia, and New Zealand after some domains briefly resolved to underlying servers. The sites sat behind Cloudflare, and Kela described shared servers that could survive the removal of an individual domain.
Sources: S1
The IP-based response changes the meaning of routine validation. Kela said a victim commonly follows the link once, whereas a scanner, security team, or takedown provider may revisit a reported site to confirm its state. If the same IP receives a convincing suspended page on that later visit, the organization conducting the check can mistake selective presentation for a completed disruption. Kela’s stated operational requirement for seeing live content was a new IP address for each check. Other domains reportedly displayed different fake notices or redirected visitors to Google, further limiting what public scanning services could capture.
Sources: S1
Sources: S1
The email-side problem is permissive trust
Microsoft’s Q3 data presents a separate but adjacent issue: familiar business workflows can turn a sender identity into a bypass opportunity. Microsoft detected approximately 129 million malicious messages spoofing tracked business-service domains during the quarter. It reported that activity had remained at roughly 41 million to 46 million messages a month since at least May. In September, overrides applied to 63% of messages with a recorded security outcome, with tenant-level overrides accounting for most of those cases.
Sources: S2
The report is careful about the limit of that evidence. The figures do not establish that recipients opened the messages or that accounts were compromised. They do establish that malicious messages which failed authentication checks could nonetheless be delivered where an override applied. This is an implementation choice within an organization, not evidence that an exception is inherently unsafe or that any particular workflow must be blocked. But it makes exception scope, ownership, and review part of the phishing defense rather than a purely administrative setting.
Sources: S2
Sources: S2
The practical dependency: delivery controls and web-response verification
The sources connect at the handoff between email and web defense. Microsoft reported that credential theft was the dominant objective in payload-based attacks during Q3, with approximately 94–96% directing recipients to a phishing site or showing a fraudulent local sign-in page. Kela’s bank look-alikes are likewise designed to collect a user ID and password. A message that reaches a recipient through an exception therefore creates more than an inbox problem: it can send that person to a site whose behavior may frustrate later investigation and takedown confirmation.
Inference: defenders should treat email policy and phishing-site validation as a linked operating process. Narrowing an unnecessary override can prevent a recipient from reaching a credential page. Separately, a takedown workflow that treats a second visit from the same network as conclusive may misread the site’s state. Neither action alone resolves the other weakness. The first governs whether a lure reaches a user; the second governs whether responders can verify that the destination has actually stopped serving new targets.
What to test before declaring protection effective
For security teams, the immediate question is not simply whether filtering identifies phishing. It is whether exceptions are narrowly tied to a documented business need and whether their continued use is visible. Microsoft’s findings point especially to exceptions associated with business-service impersonation, where document, invoice, survey, payroll, and similar workflows make a claimed sender identity seem routine. Microsoft also reported continued shifts in delivery methods, including a recovery in CAPTCHA-gated phishing and renewed SVG use, underscoring that a control tuned to one attachment pattern may not describe the current exposure.
Sources: S2
For incident responders and takedown providers, the corresponding question is whether a reported site was tested under conditions that could reveal selective content. Kela identified repeat-visit behavior, Cloudflare-fronted domains, and shared hosting as factors that made its observed infrastructure difficult to disrupt. Evidence that would change this assessment includes verification that the site returns the same content to new and repeat visitors across distinct IP addresses; records showing an exception did not apply to the delivered message; or telemetry showing that a removal action stopped first-visit phishing content rather than only changing what later checks observe.
Why it matters
Phishing resilience depends on more than a detector’s verdict. The reported campaigns show two distinct ways the operational chain can break: an attacker can make a live credential site look inactive to repeat reviewers, or a local exception can allow a known malicious impersonation message through. Measuring success should therefore include the conditions under which a site is verified and the conditions under which a detection may be overridden—not only aggregate detection volume.
Sources
- Bank Phishing Sites Show Fake ‘Suspended’ Pages to Evade Takedowns — SecurityWeek ·
- Email threat landscape: Q3 2026 trends and insights — Microsoft Security Blog ·