The fake banks had already deleted the sentence that found them

Allure Security found its population with one awkward sentence. An exact search for "one of the largest digital banking providers" in the source code of publicly available websites returned roughly 2,200 domains ^[1]. The team then tried to connect to all of them under a uniform collection method: 1,095 returned a page with an HTTP 200 response, and 1,105 returned nothing successful at all during the collection window ^[2]. Of the sites that did answer, 838 still carried the phrase and 257 had removed or modified it ^[3]. That second number is the interesting one. It is about 23 percent of everything still standing ^[1], which means that within one collection period, roughly a quarter of the live operators had already edited away the only feature that had identified them.

This is what an adversary-owned input looks like in practice. The signal was not a measurement of the sites; it was a string the sites' operators controlled, and a meaningful share of them exercised that control.

The artifacts nobody had a reason to fix

What survived is more instructive than what was scrubbed. Among the sites that still carried the phrase, 810 (97 percent) retained artifacts derived from the Cuex template, 790 (94 percent) showed signs of the Laravel PHP framework, 756 (90 percent) still displayed the misspelled templated heading "Curreny Charts", and 779 (93 percent) fell into a single dominant cluster when the signals were combined ^[4]. Cuex is a commercially available front-end template for currency exchange, money transfer, loans and digital-banking sites, and a regular license cost $25 at the time of Allure's review ^[5].

Allure notes that the current public Cuex demo still contains the "Curreny Charts" typo but does not contain the search sentence or the Laravel application behaviour tracked across the data set ^[6]. So the front end is off the shelf and the machinery behind it, sessions, routes, forms, registration, account access, came from a downstream adaptation. The typo persisted at 90 percent because correcting a vendor's spelling error costs attention and returns nothing to the operator. The marketing sentence got deleted because it was the thing being searched. Cheap, incidental artifacts outlive deliberate ones, and any detection built on the deliberate ones has a half-life set by the adversary's attention budget.

The economics explain the volume. If one $25 license was reused across the 810 sites carrying its artifacts, the visible layer cost about three cents per fabricated institution ^[2].

Fabricated third-party evidence, priced by the item

What the $25 buys is not a website. Allure describes the template being adapted into applications with login and registration forms, investment and transfer language, account dashboards and other bank-like functions, working alongside corporate details, compliance claims and support channels to make an invented institution look credible, a pattern the firm calls legitimacy stacking, and one that supplies pretext for investment, loan, romance, recovery and advance-fee fraud ^[7].

Read that as a list of inputs rather than a list of features. Corporate details, a compliance claim and a working support channel are exactly the artifacts an automated diligence check treats as evidence that an institution exists. Here they are generated to order.

The investigation's origin makes the point sharper. It started with a support ticket on a suspicious domain resembling the brand of one of Allure's financial services clients, except the page carried none of the client's logo, language or branding and instead presented an apparently unrelated bank ^[9]. The domain was inventory; the institution was invented. Inside the code, developers had left comments such as "matches Site A" and "Applies to all sections from Site B" under otherwise unrelated brands, plus a retained comment from HTTrack, a website-copying program, naming the source of the mirror ^[8]. Allure is careful that this lineage has limited attribution value, because shared code can come from a common developer or operator, an application-kit seller or reseller, or a shared deployment ^[10]. The honest read is that the manufacturing is industrial and the manufacturer is not identified.

One field, changed in flight

The second incident operates on a single value rather than a whole institution. Academics at the University of Massachusetts Amherst built an attack that revives expired contactless cards for new transactions ^[11]. NFC card data is not fully encrypted during a payment, and some parameters can be modified without breaking the card's hash or signature, so the researchers' rig intercepts the transaction as a man in the middle, rewrites the expiration date, and relays the modified payment to a point-of-sale terminal ^[12].

The reason this went unexamined is a delegation nobody wrote down: according to the research team, banks typically leave the expiry check to the POS terminal where the transaction occurs and trust its decision ^[13]. Three of the four major providers, Mastercard, American Express and Discover, used terminals where changing the date produced a signature mismatch and the transaction failed. On Visa terminals it worked, and it was not caught by any of the five banks whose backends the researchers tested ^[14]. No specialised equipment was needed, only basic NFC emulators and terminals purchasable online, with the sole awkward requirement being physical possession of expired cards, collected from the trash or from users who did not destroy them ^[15]. The study's headline recommendation was aimed at cardholders: cut up old cards ^[16].

That recommendation is a tell about where the fix is cheap rather than where the defect is. The defect is that the field a bank relies on is validated by a device the bank does not control, and the validation result arrives as an assertion, not as evidence.

When the manipulated input is your own accounting

The third case moves the edit inside the system. CertiK put Maya Protocol's direct loss at about $1.7 million after an attacker deceived Maya into awarding a nonexistent subsidy, then repeatedly added and removed liquidity to extract assets from shared pools, an event CertiK identified on August 19 ^[17]. DefiLlama's Hacks and Exploits Database classified the August 18 occurrence as "Protocol Logic" with the same $1.7 million loss ^[18]. Developer Vini Barbosa described a sophisticated six-bug exploit that removed over $1.36 million in hard assets but carried an overall impact near $11 million once CACAO fell from $0.115 to $0.013, nearly 89 percent, in under 240 blocks ^[19]. On those numbers the market damage is roughly eight times the assets actually taken ^[4].

The fake subsidy is the same behaviour as the rewritten expiry date, one level deeper: the attacker did not steal from a ledger, the attacker edited what the ledger believed it owed. That is why the detection story is bleak. Pinpointing the cause required examining cryptographic configuration parameters and hunting for insignificant prime numbers that should not have been present in order to identify affected vaults, and a simple balance monitor can only register a loss after funds have changed hands ^[23]. THORChain's own $10.7 million hack in May had the same property: a new node operator abused weaknesses in the GG20 threshold-signature system, and solvency checks only noticed once it was over ^[21]. Maya's founder Aaluxx said the THORChain event chained three older bugs, none dangerous alone, and that Maya carried the same latent flaw, which THORChain's post-mortem notes had not previously been exploited ^[22]. Monitors keyed to balances are computed from the state the attacker is manipulating, so they confirm the theft rather than interrupt it.

The compromised publisher as a data source

Positive Technologies reports that in the first half of 2026 it found the East Asian group FamousSparrow running a new backdoor it named SquawkDoor alongside an updated SparrowDoor, with primary targets in Nepal, the Philippines, Indonesia, Taiwan, Egypt, Germany and the Czech Republic ^[35]. The delivery vector was compromised websites carrying injected JavaScript that showed a fake error and prompted visitors to download a certificate, which was really a malicious MSI installing the backdoors, confirmed in at least Taiwan, Germany, Indonesia and the Czech Republic ^[36]. In one case the group had access to an information system belonging to an international research organisation focused on food security, and injected the certificate lure on that organisation's platform, where the likely targets were researchers using it as a library and a place to publish ^[37]. The script's text was tailored per country and it included infection statistics endpoints at /report-url and /track-download, though no mass infection was observed even though the functionality supports scaling ^[38]. FamousSparrow, also known as Salt Typhoon and Earth Estries, has been active since 2019 and later moved onto telecommunications firms and ISPs, apparently seeking durable access to lawful intercept systems ^[39].

A research library is upstream of a great deal of downstream work. When the party editing its pages is selecting visitors by country and counting downloads, the content served by a trusted institution has become a channel with a targeting layer.

The asymmetry: they edit in days, we do not delete in years

Set the 257 scrubbed sites ^[3] against what happens on the defending side of the same problem. Truffle Security's scanners have verified 64,024 unique AWS key pairs across 431,875 public findings, drawn from git history, Hugging Face datasets, Docker images, package registries and CI logs ^[28]. The largest single source is Hugging Face, with 8,482 unique live keys across 3,394 public datasets, 17.9 percent of them root, the highest root share of any source tracked, and most of those datasets are snapshots of public code repackaged for training, so a key committed once ends up tokenized into corpora that thousands of downstream projects pull ^[29]. That is about 2.5 live keys per dataset ^[5].

Re-verified on August 10, 2026, from a set that surfaced publicly between August 2022 and August 2026, 88 percent of the 10,616 keys still authenticate ^[26]. The median live leaked key was created 1,831 days ago, and among the 2,903 keys where sibling keys could be enumerated only 13.7 percent had a newer key alongside the leaked one, leaving 86 percent never rotated or cleaned up ^[30]. Worse, 929 of 7,590 active IAM users carry AWS's own compromised-key quarantine policy, and 112 carry the original version AWS stopped applying in 2023, meaning they were flagged at least three years ago, their owners notified, and they still authenticate ^[31].

So the parties with fraud revenue at stake removed an identifying string from hundreds of sites inside one collection window, while credentials sitting in public training corpora survive five years and an explicit vendor notification. Whatever the defender's data pipeline believes about freshness, the adversary's editing loop is the faster one.

What this constrains

The four inputs in these cases, a string in page source, a payment field, a protocol's internal accounting, and the content of a public research platform, share one property: each is asserted by a party with a financial interest in the answer, and each is read by something that treats the assertion as measurement. The design consequence is narrow and specific. A check placed where the interested party can reach it, the POS terminal rather than the issuer backend ^[13], produces a validation record without validation. A monitor computed from state the attacker is editing, such as balances or solvency checks, reports the outcome after the fact ^[23]. Signals the counterparty is motivated to groom decay quickly ^[3]; incidental ones, a vendor's spelling error or a framework fingerprint, persisted across 90 to 94 percent of the population ^[4].

Aaluxx's own reading of the trend is that AI lets small teams examine codebases from many angles at once, which helps defenders but also multiplies the ways attackers find unique flaws that existing audit processes miss ^[25]. That cuts both ways for anyone building features on third-party inputs: the cost of generating plausible evidence keeps falling, and the cost of noticing that the evidence was generated does not fall with it.