Cybersecurity researchers have uncovered a network of hundreds of fraudulent banking websites, many of which share common elements from a $25 commercial website template. The investigation, initiated by Allure Security, began when a researcher noticed a suspicious domain impersonating a client's brand, but displaying an unrelated bank with the phrase "one of the largest digital banking providers." A search for this specific phrase in public website source code revealed approximately 2,200 matching domains.
Further analysis by the research team revealed that nearly half of these domains, specifically 1,095, were active websites. Of those, 838 still contained the initial search phrase. A striking 97% of these 838 sites, totaling 810, retained components of "Cuex," a front-end template designed for currency exchange and digital banking, which was available for $25. Additionally, 94% of the sites utilized the Laravel PHP framework for functions like logins and session management, and 90% featured a misspelled heading from the template, "Curreny Charts."
The researchers describe this pattern as "legitimacy stacking," where various elements such as banking interfaces, dashboards, investment product details, corporate information, and support contacts are layered to create a credible appearance for an invented financial institution. Among the 838 identified sites, 770 presented login pages, 767 set session cookies, and 729 included anti-forgery tokens, indicating they were designed to collect and store user data.
This infrastructure aligns with a common fraud model where victims are introduced to a seemingly legitimate financial institution by a scammer, such as a fake broker, romantic interest, or loan agent. The fraudulent portal then provides a persistent interface to display fabricated accounts, balances, investment gains, and details about transfers, holds, or withdrawal issues, lending credibility to the scam.
One particular site, branded as "Classtands Crest," provided a crucial lead due to a sloppy copy-paste error. Its account creation page's source code still contained the title "Create an Account- Remedy bank." More significantly, the registration form on this site was configured to send submitted data to a separate domain, remedycodes[.]site. This "Remedy" address had previously been linked to two other sites flagged for suspected fraud.
Researchers recommend that individuals investigating potential phantom banks look for several tell-tale signs. These include the "Curreny Charts" typo, shared website paths and code, matching cookies, identical contact details, and registration forms that direct data to the same external destination. They also advise independently verifying any claims made by the financial institution and preserving evidence such as page content, timestamps, hashes, and source code to support their findings. The investigation highlights how a single copied sentence can expose a large network of fraudulent sites, and understanding their relationships requires tracing the underlying application and its "legitimacy stack."
