Skip to content

FBI Seizure of Fraud Domain Hosting Stolen Bank Credentials

FBI domain seizure

Bank Fraud Phishing Campaign $14.6M Losses Domain Seizure

Overview

The FBI seized a domain used by cybercriminals to store and manage stolen online banking credentials from U.S. victims. The domain served as a centralized backend panel where attackers collected and accessed victim login data harvested through malicious search engine advertisements impersonating legitimate bank websites. The operation resulted in at least \(14.6 million in confirmed losses** and approximately **\)28 million in attempted fraudulent transfers affecting multiple U.S. individuals and businesses. The attack leveraged fake bank websites closely mimicking legitimate banking portals, promoted through sponsored Google and Bing ads that appeared above genuine search results. Victims entering credentials on phishing sites had their data transmitted to the attacker-controlled domain (web3adspanels.org), enabling account takeovers and fraudulent wire transfers. The seizure represents significant law enforcement action against ad-based phishing infrastructure targeting the financial sector.

Operation Specifications

Attribute Details
Law Enforcement Action FBI Domain Seizure
Seized Domain web3adspanels.org (attacker-controlled credential storage)
Attack Type Malicious Advertisement (Malvertising) + Phishing + Bank Account Takeover
Distribution Vector Google and Bing sponsored search advertisements
Target Victims U.S. individuals and businesses (online banking customers)
Credential Theft Method Fake banking websites mimicking legitimate portals
Confirmed Losses At least $14.6 Million
Attempted Fraud Approximately $28 Million in fraudulent transfer attempts
Victim Count Multiple U.S. victims (exact number not disclosed)
Fraud Mechanism Account takeover, fraudulent wire transfers, unauthorized withdrawals
Infrastructure Centralized backend database for credential storage and management
Attack Duration Undisclosed (likely months to years before detection)
Attribution Organized cybercriminal group (no public attribution)
Law Enforcement FBI Cyber Division, U.S. Department of Justice

Technical Details

Malicious Advertisement Infrastructure

The attack relied on abuse of search engine advertising platforms:

  • Sponsored Search Ads: Attackers purchased Google Ads and Microsoft Bing Ads targeting banking-related keywords (e.g., "Bank of America login", "Chase online banking", "Wells Fargo sign in")
  • Ad Positioning: Malicious ads appeared at top of search results, above legitimate bank websites, exploiting user tendency to click first result
  • Lookalike Domains: Phishing sites hosted on domains visually similar to legitimate banks (e.g., bankofamerica-secure[.]com, chase-onlinebanking[.]net, using hyphens, typosquatting, or alternate TLDs)
  • Ad Copy Mimicry: Advertisement text matched legitimate bank ads, including official-sounding language, security badges, and brand terminology
  • Geographic Targeting: Ads potentially geo-targeted to U.S. users to maximize relevance and victim pool

Fake Banking Websites

Phishing sites employed sophisticated impersonation techniques:

  • Visual Cloning: Websites replicated legitimate bank login pages with identical logos, color schemes, layouts, and branding elements
  • SSL/HTTPS: Phishing sites used HTTPS certificates (often free Let's Encrypt certificates) to display padlock icon in browser, creating false sense of security
  • Interactive Elements: Included working form fields, JavaScript validation, and multi-step login processes mimicking real banking interfaces
  • Evasion Techniques: Likely implemented anti-analysis measures such as IP geofencing (blocking security researchers), user-agent filtering, or time-based activation

Credential Capture Mechanism

Stolen data was collected through web-based interception:

  • JavaScript Capture: Web forms embedded malicious JavaScript that transmitted entered credentials to attacker-controlled servers in real-time
  • Backend Transmission: Data sent via HTTPS POST requests to web3adspanels.org or intermediate servers, then stored in centralized database
  • Data Logged: Captured information included:
    • Username/account numbers
    • Passwords
    • Security question answers (if prompted)
    • Two-factor authentication codes (if victims entered on phishing site)
    • Victim IP addresses and browser fingerprints
    • Timestamps of credential entry

Attacker Control Panel (Seized Domain)

web3adspanels.org functioned as administrative backend:

  • Credential Database: Centralized repository storing all harvested credentials organized by bank, victim, and timestamp
  • Management Interface: Web-based panel allowing attackers to search, sort, and export stolen credentials
  • Real-Time Updates: New credentials added to database as victims submitted forms on phishing sites
  • Multi-Operator Access: Likely supported multiple criminal operators accessing same credential database (organized crime model)
  • Monetization: Credentials potentially sold to other criminals or used directly by operators for account takeover

Fraudulent Banking Activity

Attackers leveraged stolen credentials for financial fraud:

  • Account Login: Used victim credentials to authenticate to real bank websites from attacker-controlled infrastructure
  • Evasion Tactics: Employed residential proxies or VPNs to mask attacker IP addresses and appear as legitimate customer logins
  • Fraudulent Transfers: Initiated wire transfers, ACH payments, or bill payments to attacker-controlled mule accounts or cryptocurrency exchanges
  • Withdrawal Attempts: Where possible, added external bank accounts or changed contact information to facilitate fund exfiltration
  • Credential Testing: Tested credentials shortly after capture while sessions still active and before victims noticed compromise

Attack Scenario

Step-by-Step Fraud Operation

  1. Malicious Ad Campaign Setup
    Cybercriminals create Google Ads and Bing Ads accounts using stolen identities or fake business credentials. Purchase sponsored search ads targeting high-value banking keywords. Configure ads to redirect to phishing sites hosted on lookalike domains. Ads appear above legitimate bank websites in search results.

  2. Victim Searches for Bank
    U.S. banking customer searches for their bank using Google or Bing (e.g., "Chase bank login", "Bank of America online"). Victim sees malicious sponsored ad at top of results, appearing identical to legitimate bank advertisement. Clicks ad believing it's official bank website.

  3. Redirect to Fake Banking Portal
    Victim lands on phishing website perfectly mimicking legitimate bank login page. URL may use lookalike domain (e.g., chase-secure-login[.]com). HTTPS padlock icon displayed, creating false sense of security. Victim does not notice subtle domain differences.

  4. Credential Entry and Capture
    Victim enters username and password into fake login form. If bank uses security questions or soft-token codes, phishing site prompts for those as well. JavaScript capture script transmits credentials to attacker server in real-time. Credentials stored in web3adspanels.org backend database.

  5. Victim Receives Fake Error Message
    After credential submission, victim redirected to fake error page ("System temporarily unavailable", "Incorrect credentials") or automatically redirected to real bank website (forcing victim to re-enter credentials, making them believe initial attempt failed). Victim may not immediately realize compromise.

  6. Attacker Account Takeover
    Cybercriminals access web3adspanels.org control panel, retrieve freshly captured credentials. Log into victim's real bank account using stolen credentials. Verify account balance and transaction limits. Initiate fraudulent wire transfers or ACH payments to mule accounts or cryptocurrency exchanges. Attempt to modify account settings (add external accounts, change contact info).

  7. Victim Discovers Fraud
    Hours to days later, victim notices unauthorized transactions in bank account. Reports fraud to bank. Bank initiates investigation, reverses some transactions (where possible). Victim changes credentials, but damage already done. If credentials reused on other sites (common password reuse), secondary accounts also at risk.

  8. FBI Investigation and Domain Seizure
    Financial institutions report pattern of account takeovers to FBI. FBI traces fraudulent activity back to web3adspanels.org infrastructure. Obtains court order for domain seizure. Seizes domain and underlying server, recovering credential database for victim notification. Ongoing investigation to identify and prosecute perpetrators.

Impact Assessment

  • $14.6 million in confirmed losses represent direct financial harm to victims.
  • $28 million in attempted transfers indicate scale of fraud (many attempts blocked by bank fraud detection).
  • Individual victims lost thousands to hundreds of thousands per incident. Businesses particularly hard-hit by large fraudulent wire transfers.
  • Bank reimbursement policies vary—some victims fully reimbursed, others face partial losses depending on negligence determinations.
  • Indirect costs include overdraft fees, legal expenses, credit monitoring, and lost productivity during recovery.
  • Stolen credentials enable secondary fraud: attackers test credentials on other websites (credential stuffing), access email accounts if same password used, compromise related accounts.
  • Password reuse common—victims using same credentials for banking, email, e-commerce, and work accounts face cascading compromise.
  • Personal information collected during phishing (names, account numbers, security questions) enables identity theft, synthetic identity fraud, and targeted phishing against victim contacts.
  • Incident erodes trust in online banking and search engine advertisements.
  • Customers question safety of digital banking services.
  • Ad-based phishing undermines confidence in legitimate sponsored search results—users may avoid all ads even from legitimate advertisers.
  • Banks face reputational damage from widespread account takeovers.
  • Public education needed to restore trust. Behavioral change required: users must verify URLs manually rather than trusting search results.
  • Operation demonstrates vulnerability of advertisement platforms to abuse.
  • Google and Microsoft face pressure to improve ad vetting processes.
  • Centralized credential storage (web3adspanels.org) created single point of failure—seizure recovered large credential database, but criminals may have backups.
  • If credentials exported before seizure, ongoing fraud risk persists.
  • Precedent set for future law enforcement targeting of phishing infrastructure.

Mitigation Strategies

For Individual Banking Customers

  • Avoid Clicking Search Ads: Never click sponsored ads when searching for banks. Scroll past sponsored results to organic links, or better yet, use direct navigation methods below.
  • Bookmark Banking Websites: Create browser bookmarks for bank login pages on first verified visit. Always use bookmarks to access online banking. Prevents accidental navigation to phishing sites.
  • Manually Type URLs: Type bank URLs directly into address bar (e.g., chase.com, bankofamerica.com). Verify HTTPS and correct domain before entering credentials. Check for green padlock, but remember phishing sites also have HTTPS.
  • Enable Multi-Factor Authentication (MFA): Activate strongest MFA available for bank accounts: hardware security keys (FIDO2/U2F), authenticator apps (Google Authenticator, Authy), or bank-issued tokens. Avoid SMS-based MFA where possible (vulnerable to SIM swapping). MFA prevents account takeover even if password stolen.
  • Use Password Managers: Use password manager (1Password, Bitwarden, LastPass) to generate and store unique passwords for each account. Password managers auto-fill credentials only on legitimate domains, preventing entry on phishing sites.
  • Monitor Account Activity: Enable real-time transaction alerts via bank mobile app, email, or SMS. Review account statements weekly. Report suspicious activity immediately. Many banks offer fraud alerts for unusual login locations or large transfers.

For Financial Institutions

  • Lookalike Domain Monitoring: Deploy domain monitoring services to detect typosquatting and lookalike domains impersonating your brand. Services: DomainTools, Bolster, PhishLabs. Take down phishing sites via abuse complaints and legal action.
  • Implement Behavioral Analytics: Deploy behavioral biometrics and device fingerprinting to detect account takeovers: unusual login locations, new devices, atypical transaction patterns, rapid fund movement. Challenge suspicious logins with step-up authentication.
  • Strengthen MFA Requirements: Mandate phishing-resistant MFA for high-risk transactions: wire transfers, external account additions, contact info changes. Implement hardware token programs for business customers.
  • Customer Education Campaigns: Educate customers on ad-based phishing risks via email, mobile app notifications, and website banners. Provide guidance: bookmark banking URLs, ignore search ads, verify domains. Run simulated phishing campaigns to test awareness.
  • Collaborate with Law Enforcement: Establish partnerships with FBI Cyber Division, IC3 (Internet Crime Complaint Center), and FS-ISAC (Financial Services ISAC). Report phishing infrastructure, share threat intelligence, and coordinate takedown operations.

For Search Engine Providers

  • Enhanced Ad Verification: Strengthen advertiser identity verification requirements. Require government-issued ID, business registration documents, and bank verification for accounts purchasing financial services ads. Increase cooling-off periods before ads go live.
  • Domain Reputation Checks: Integrate domain reputation services (e.g., Google Safe Browsing, PhishTank) into ad approval process. Block ads redirecting to newly-registered domains (< 30 days old), suspicious TLDs, or lookalike domains.
  • Real-Time Monitoring: Deploy machine learning to detect malicious ad patterns: mimicry of financial institutions, use of urgency language, redirect chains, mismatched display URLs and landing pages. Automatically suspend suspicious campaigns.
  • Rapid Takedown Procedures: Establish 24/7 phishing report hotlines for financial institutions. Implement automated takedown for confirmed phishing ads within minutes. Blacklist associated advertiser accounts and payment methods.
  • Transparency and Reporting: Publish transparency reports detailing malicious ad takedowns, phishing campaign statistics, and cooperation with law enforcement. Demonstrate commitment to ad platform safety.

For Law Enforcement

  • Rapid Infrastructure Seizure: Prioritize domain and server seizures for active phishing operations. Coordinate with domain registrars and hosting providers for expedited takedowns. Preserve forensic evidence for prosecution.
  • International Coordination: Many phishing operations use offshore hosting and international payment processing. Coordinate with Europol, Interpol, and foreign law enforcement via MLATs (Mutual Legal Assistance Treaties).
  • Victim Notification: Use seized credential databases to notify victims of compromise via bank partnerships or direct outreach. Provide remediation guidance: change passwords, enable MFA, monitor accounts.
  • Criminal Prosecution: Pursue charges against operators: wire fraud, identity theft, computer fraud (18 U.S.C. § 1343, 18 U.S.C. § 1028, 18 U.S.C. § 1030). Publicize arrests and convictions to deter future attacks.

Technical Detection

  • URL Analysis: Train users and deploy browser extensions detecting lookalike domains. Tools: Netcraft Anti-Phishing Extension, Microsoft Edge SmartScreen, built-in Chrome Safe Browsing.
  • Certificate Transparency Monitoring: Monitor Certificate Transparency logs for newly-issued SSL certificates containing your brand name. Investigate suspicious certificates for phishing sites.
  • Threat Intelligence Feeds: Subscribe to phishing intelligence feeds (PhishTank, OpenPhish, APWG, FS-ISAC) for real-time indicators of compromise. Block known phishing domains at DNS or firewall level.

Resources

Incident Coverage