Lab539 links 380+ domains to fake bank support sites and infrastructure pushing remote-access software

What happened

BankInfoSecurity reported on October 20, 2026 on new research from British threat intelligence firm Lab539 into a phone-led fraud operation targeting banking customers that has been live since at least March. Lab539 says more than 380 registered domains are tied to the actor's fake support sites and infrastructure, including cloned help or support sites for Barclays, HSBC, Lloyds, Revolut, Santander and other financial firms; those banks are the brands being copied, not the operators. The cloned pages add buttons such as 'Verify Call', 'Live Chat', 'Generate Case ID', 'Security Check' or 'Fraud Report', which a fake call centre tells callers to click, followed by a verification code supplied over the phone. According to the report, 'Live Chat' downloads a genuine AnyDesk installer; 'Verify Call' delivers verify_call.exe, presented as a 'ShieldWall Defender' tool but actually a ScreenConnect installer with extra code to disable some security tools and escalate privileges; and FraudReport.zip pairs a genuine Microsoft Defender component with a malicious mpclient.dll that again installs ScreenConnect. BankInfoSecurity says how the attackers first engage victims isn't clear but likely involves telephone-oriented attack delivery (TOAD), phishing or both. Lab539 says the campaign remains active.

How the scam works

According to BankInfoSecurity, the aim is to get victims talking to a fake, attacker-run call centre they believe is their bank, and to persuade them to install remote-support software. In telephone-oriented attack delivery, the victim is tricked into making the call, often after an email such as a fake invoice that lists a phone number but contains no malicious links or attachments, which helps it get past email filters.

On the cloned support page, the caller is told to click one of the added buttons and then enter a verification code read out by the fraudster, which researchers say makes the process feel like part of a real bank workflow. Different buttons lead to different attack chains. AnyDesk, ScreenConnect and Microsoft Defender are legitimate products being abused, not the operators.

The verify_call.exe file and the malicious mpclient.dll were signed with digital certificates issued to Botania Games in Japan, by Sectigo and GlobalSign. Researchers say it isn't clear whether Botania Games is connected to the attacks. Lab539 reported both certificates on 9 October and says they have been revoked. As of 20 October, the two files were flagged as malicious by only 30 and 23 of 69 antivirus engines. A real bank will not ask you to install software or read out a code so that it can 'verify' a call.

Source

BankInfoSecurity, "Fraudsters Clone Bank Support Pages, Urge Victims to Call" (published 20 October 2026).