British threat-intelligence firm Lab539 has detailed a phone-led fraud operation, live since at least March 2026, that builds convincing copies of banks' customer-support sites and talks victims into installing legitimate remote-support software. The campaign spans more than 380 registered domains, including cloned help pages for Barclays, HSBC, Lloyds, Revolut and Santander, and adds fake workflow buttons — "Verify Call", "Live Chat", "Generate Case ID", "Security Check" and "Fraud Report" — that hand the attacker one-time remote access. The Live Chat path downloads a genuine AnyDesk installer while other chains deliver custom-signed payloads such as verify_call.exe, and researchers classify the technique as telephone-oriented attack delivery (TOAD), using lures that contain no links or attachments and so slip past email gateways. Why it matters: the operation weaponises bank-brand trust rather than a software flaw, so allow-listing and signature-based defences will not stop it — only customer-side call-verification discipline and takedown of the cloned estate will.

• Source article