Same bot, new domain: a US banking phishing campaign

The domains changed; the packaged collection settings did not. Two banking phishing kits exposed on secure247-online.com on 1st October 2026 matched September archives byte for byte and still named the same Telegram bot and destination chat.

The kits copied Texans Credit Union and First United Bank. Their shared backend joined two rounds of credential collection, a one-time-code prompt, and a dependency on an external visitor-screening service. Related public records also showed Adventure Credit Union, KEMBA Financial Credit Union, and Erie Community Federal Credit Union.

An open directory exposed the kits

The Sandfish analysis captured an Apache directory listing on secure247-online.com. The directory exposed two ZIP archives:

The domain was registered through Hostinger on 30th September. It used Cloudflare nameservers and a Let's Encrypt certificate. The directory listed 18th September timestamps for the archives. These dates suggested that the files were older than the domain. The matching hashes provided stronger evidence of reuse.

The same archives appeared in September

These records show where and when the archives appeared:

• First United Bank.zip on fdichelpsupport.com had SHA-256 1503ad9a...572df on 18th September.
• Texans CU.zip on mytexanscu.org had SHA-256 378a4496...4f118 on 19th September.
• The Sandfish analysis recovered the same Texans archive on 2nd October.
• A urlscan capture of the new host also recorded the open directory.

The matching SHA-256 hashes show that the September and October archives were identical. The archive contents had not changed between captures. The hashes link the packages more strongly than similar page designs or shared hosting would. They also preserve the collection configuration inside those packages. They do not establish who copied the files or whether a deployed copy later changed its settings.

Public scans linked the September hosts to 138.197.128.232, a DigitalOcean address. The table lists those records and the later capture on secure247-online.com. All dates are in 2026.

At the time of the investigation, the earlier domains were suspended or deleted. secure247-online.com remained accessible through Cloudflare.

A capture recorded the phishing login page

Most reviewed urlscan submissions opened an archive or reached a PHP path that returned HTTP 404. One capture recorded an active phishing page that copied the Adventure Credit Union login page.

These captures show a login page followed by a 404 response. They do not establish how long the page was active or why the response changed. The open directories provide separate evidence that the hosts stored the kit archives.

How the kit works

The Texans and First United kits share the same server-side code. They use different copied pages and brand text.

1. The entry page records visitor information

index.php starts a PHP session and stores the HTTP referer, which may name the referring page but can be absent or spoofed. It also accepts an optional user query parameter and stores its value as $_SESSION['Maill']. This permits links with a recipient address. The inspected code does not include that stored address in later Telegram messages.

The entry page then redirects the browser to JS?ua= with the value of navigator.userAgent. Rewrite rules remove the .php extension from the URL.

2. Browser checks try to block analysis systems

JS.php calls the main anti-bot code and sends JavaScript to check these browser properties and methods:

• navigator.webdriver;
• navigator.doNotTrack;
• navigator.cookieEnabled;
• navigator.getBattery();
• navigator.getVRDisplays().

The code labels the battery check as laptop detection. It labels the VR-display check as virtual-machine or remote-desktop detection. These checks are unreliable. For example, the VR API cannot establish whether a visitor uses remote desktop. Several checks can also start redirects independently. The resulting destination can depend on which check finishes first.

The Apache configuration rejects requests with common proxy headers, such as Via or X-Forwarded-For. It also sets an X-Robots-Tag header to restrict indexing. The sitemap lists only an "under construction" page.

3. A remote service decides whether to allow access

The main anti-bot code collects the IP address, user agent, referer, and policy flags. It encodes these parameters in Base64 and sends them to:

hxxps://bestwaytohelpyourfamilyandself[.]com/GDG/index.php?Value=<base64>

The code expects a response with status and cause fields. If the service classifies the visitor as a bot, the kit records the cause and redirects to a decoy page. If the service classifies the visitor as a client, the kit records a click and allows access to the login page.

The configuration includes optional calls to AntiBot.PW, KillBot, GetIPIntel, and IPTrooper. Some code paths contain errors. The KillBot code tries to decode an undefined variable. Both archives reference missing logintoyouraccount/OP.txt and OF.txt files. These defects can affect deployment.

During the investigation, a lookup found no current registration for the main anti-bot domain. The inspected fallback path redirects visitors when the service supplies no usable decision; we did not reproduce that behavior across deployed PHP environments. This creates an external dependency before the credential page: intact kit files alone do not guarantee a working lure. A later registrant of the hard-coded domain could potentially receive visitor-check requests from surviving deployments. No such takeover was observed.

4. The victim enters credentials twice

In the inspected PHP code, the first login form posts username and password to processing/login.php. The handler sends both values to Telegram, then redirects to a second login page.

The second page asks for the username and password again, then sends another Telegram message. This is a fixed two-pass collection flow. The inspected handlers do not verify the first password with the bank before asking again. A second attempt could correct a typing error, but the retry itself is not evidence that the bank rejected the first attempt.

The handlers include the victim's IP address, user agent, and a timestamp. Telegram delivery is enabled. The email and ICQ delivery options are disabled.

5. The kit asks for the one-time code

After the second credential submission, cod.php tells the victim that the bank sent a text message. The page submits the entered code to processing/cod.php. That handler sends a third Telegram message.

The kit collects credentials and the one-time code separately. It does not act as an adversary-in-the-middle proxy that relays a live bank session. Successful use of a time-limited code would require a separate, timely bank interaction. The archive establishes the collection sequence, not that such an interaction succeeded.

The final page waits six seconds, then redirects to the bank's real website.

Files and metadata show code reuse

The archives include files and text from other sites:

• The Texans archive includes old Truist files in processing/done_files/.
• Its yba/ directory contains a saved cPanel login template.
• The Texans one-time-code page still displays "cPanel Terms of Use."
• A saved Cloudflare challenge in that template contains a timestamp for 23rd December 2024 at 15:34:16 UTC.
• The First United archive contains a Windows shortcut named lolo - Shortcut.lnk.

The shortcut records the path C:\Users\DELL\Downloads\First United Bank\file\lolo.png and machine name desktop-e0v2u9o. It also contains an Intel MAC address. Its UUIDv1 field contains the timestamp 26th January 2025 at 19:14:16 UTC. These values describe an environment associated with the shortcut. They do not identify a person or establish where the full kit was built.

The ZIP metadata contains dates from several years. The anti-bot files have 2021 timestamps, the Truist files have 2023 timestamps, and the cPanel template has late-2024 timestamps. The bank pages have early-2025 timestamps. The Telegram configuration has September 2026 timestamps. These dates are consistent with reuse of older files, but they do not establish exact development dates.

Shared Telegram settings link the archives

Both archives contain the same Telegram bot token and destination chat ID. An earlier public analysis by Emiliano Carlesi recorded the same values on fdichelpsupport.com.

The bot token was valid during the investigation. Telegram returned these account and chat records:

• Bot: @joimeeienbot, display name hime1j1j1.
• Destination chat: Telegram user @lvelng, display name MAKE A PAYMENT ADMIN.
• Profile link: @makeapayment3, described by @lvelng as the "New channel."
• Linked channel: @makepayment45, titled MAKE A PAYMENT in Telegram API metadata.

At the time of the investigation, Telegram blocked posts at both channel handles for Terms of Service violations. It did not identify the content that caused the restrictions. The channel posts were unavailable for passive archiving. The kits were configured to send stolen data to the direct chat between the bot and @lvelng.

The bot profile also displayed a referral link for an AI proxy service. That link does not establish that the service participated in phishing.

Both kits also contain $LICENSEKEY = '@psyco_m'. A source comment tells the buyer to replace this value with "YOUR USERNAME." This suggests a buyer or licensee handle rather than a seller handle. During the investigation, the Telegram account at @psyco_m had a scam marker and public activity dating to 2021. Telegram usernames can change owners. The current account cannot be linked to this campaign from the username alone.

The archives contain the disabled fallback email [email protected] and repeated YBA labels. The investigation found no independent source that identifies YBA as a group. Here, YBA refers only to a label in the files.

The operational continuity is in the copied packages and their destination settings. Reusing an unchanged archive can preserve the same collector across new domains, while also carrying forward broken checks and obsolete service dependencies. That explains both the strong technical link and the limits of treating every exposed archive as a functioning deployment.

Indicators

Campaign infrastructure

secure247-online[.]com
fdichelpsupport[.]com
mytexanscu[.]org
eriecommunityfcu-secure[.]org
securecu-online[.]com
adventurec[.]org
kembas[.]org
computerline[.]org
comp-uterline[.]com
138[.]197[.]128[.]232

Telegram accounts and kit settings

Telegram bot:   @joimeeienbot (ID 8587481198)
Destination:    @lvelng (chat ID 5000006602)
Profile links:  @makeapayment3, @makepayment45
License value:  @psyco_m
Disabled email: yba.boss@aol[.]com
Anti-bot API:   bestwaytohelpyourfamilyandself[.]com/GDG/index.php
Redirect host:  activateyourscampage[.]com

The preserved archives contain the full bot token. This article omits it.

Archive hashes

378a44969bad2243a70c09df68b4df28e304fc370698f90d926f1d2fcfa4f118  Texans CU.zip
1503ad9ac598735f63a0d23f86a1b485170b8ed3942513928556fe2eaee572df  First United Bank.zip
48f556b6b3ef25a128e436d804d97ca58662294ea1d0be5e342c33495592ee10  ecfcu.zip

Method and limits

Updated on 9th October 2026 to clarify that the two-pass login and fallback behavior come from inspected code, and that matching packages and collection settings do not prove live success or common ownership of every host.

Sandfish preserved the October open directory, request records, screenshot, registration data, and Texans archive hash. The September evidence comes from public urlscan records. Those earlier captures are not available in Sandfish.

The investigation examined the kit files without submitting phishing forms or joining attacker channels. Telegram Bot API requests retrieved only account and chat metadata. The investigation did not collect chat history. No messages were sent to the destination chat.

The evidence establishes reuse of the archives and links their configured collection chat to @lvelng. It does not establish who operated the account, whether victims submitted data, or how much data the campaign collected.