US Financial Sector Targeted by 40,000 Phishing URLs in Early 2026

Rising Threat to US Financial Institutions

During the first six months of 2026, the American financial services industry encountered a massive surge in cyber threats, with researchers identifying nearly 40,000 unique phishing URLs. According to recent findings from Netcraft, these fraudulent campaigns are leveraging a highly fragmented ecosystem of infrastructure, complicating efforts to shut them down.

The scale of these operations is underscored by the involvement of 645 distinct hosting providers and 576 registrars. Threat actors are increasingly utilizing automated AI tools and emerging platforms to pivot quickly between services, ensuring their malicious infrastructure remains elusive.

The Role of Free Hosting and AI

A significant portion of this activity relies on low-cost or free services. Specifically, 12.6% of the phishing URLs directed at US financial institutions were hosted on free developer and application platforms. This suggests that approximately one in eight attacks is executed using infrastructure that requires zero financial investment from the attackers.

Furthermore, the integration of generative AI is streamlining these operations. AI-driven website builders and automated cloning tools allow criminals to rapidly replicate legitimate financial pages and deploy malicious sites with minimal technical expertise. Netcraft observed that the choice of infrastructure shifted notably between the first and second quarters, indicating that attackers are agile in abandoning platforms that are no longer effective.

Key Targets and Emerging Tactics

The data highlights that specific financial brands remain primary targets for impersonation:

• Payment Services: Accounted for 37.2% of phishing activity, with PayPal being the target of 80.6% of attacks within this sub-sector.
• Card Networks: American Express was the focus of 72.8% of observed campaigns in this category.

Infrastructure trends also shifted with the introduction of Omegatech, a Seychelles-based provider launched in early 2026. By June, this provider was linked to roughly 3% of phishing attacks against US financial firms. In one notable instance, a single cluster of 16 domains generated 585 unique phishing URLs, impersonating 41 different financial institutions through subdomains.

Recommendations for Defense

While some major campaigns, such as those targeting Fidelity Investments via the Darcula platform, saw a sevenfold decline from Q1 to Q2, the overall threat landscape remains volatile. Organized criminal groups, including state-sponsored entities, continue to aggressively target banks, crypto services, and personal accounts.

To combat this persistent threat, security experts advise financial companies to adopt a proactive posture:

«Organizations should prioritize the continuous monitoring of newly registered domains, implement stricter controls over suspicious links, and reinforce internal verification processes to safeguard against sophisticated impersonation attempts.»