CyberAware UK says its DarkWatch monitoring system flagged 511 potentially malicious domains resembling UK brands within 24 hours, as separate cybersecurity findings show criminals using fake technology services, telecoms infrastructure and software prompts to target consumers.
The reported total has not been independently verified, and the service has not published enough underlying detection data to establish how many of the domains were actively being used for phishing.
Phishing Pages Are Becoming Attack Infrastructure
DarkWatch said the domains imitated brands including Sky, BT, Amazon, HSBC, Barclays, Nationwide, Lloyds and PayPal. The service described the findings as live detections with direct UK relevance, rather than historical examples.
The domains are designed to look familiar, but the page is no longer simply a counterfeit shopfront. It can become the opening surface of an attack, moving a victim from a text message or email to a cloned login page, a stolen one-time code or a malicious software prompt.
CyberAware UK said criminals register brand-containing domains, build cloned login, delivery-tracking or billing pages, and create urgency through fake alerts. The stated objective is to harvest card numbers, passwords and authentication codes, potentially allowing accounts to be accessed within minutes.
The 511-domain report is separate from wider research published by Check Point Research. The company said Microsoft accounted for 33% of tracked brand-impersonation attempts in the third quarter of 2026, up from 23% in the previous quarter.
Fake Technology Updates Can Enable Device Access
Check Point Research also identified AI and developer tools as emerging phishing lures, including fake Claude payment-failure notices, a counterfeit Google Antigravity installation site, a fake Apple support page and fraudulent DocuSign update prompts.
In one example, a fake installation page displayed a Linux command that appeared legitimate. Check Point Research said the command instead decoded and ran a Base64-encoded instruction, downloaded a shell script from an external server and could provide remote code execution if the user ran it.
The DocuSign example used a different route. Clicking 'Continue' downloaded a file called fleetdeck_installer, which Check Point Research identified as a remote-management tool distributed through a fraudulent page.
The sequence is deliberately ordinary. Open the message. Follow the prompt. Run the command or install the update. What appears to be routine setup can become the point at which an attacker gains access.
The wider pattern is also visible in recent UK coverage of scams moving between phone calls and messaging platforms, including unexpected calls that direct victims to WhatsApp.
Ofcom Fines Telecoms Provider Over Number Misuse
The technology problem extends beyond cloned websites. On 21 October, Ofcom fined telecoms provider Tismi £437,500 for failing to take appropriate and proportionate steps to prevent allocated telephone numbers from being misused in scams.
Ofcom said approximately 366,000 sub-allocated numbers had been exposed to potential misuse over more than two years. The regulator said Tismi lacked sufficient customer due diligence, monitoring and a formal process for handling misuse reports.
'There's no excuse for communications providers failing to put in the proper checks and balances to prevent numbers being misused,' said George Lusty, Ofcom's Director of Enforcement.
Ofcom's action concerns telecoms-number controls, not the 511 domains identified by DarkWatch. It therefore should not be read as confirmation that the numbers or infrastructure were connected.
Police Case Shows How the Attack Moves Across Channels
Surrey and Sussex Police described a reported case in which a woman received a fraudulent banking text, followed its link and was later contacted on WhatsApp by someone impersonating Barclays' fraud team.
Police said the fraudster obtained security information and access to the woman's devices before stealing £5,000. The case is a police newsletter account, not evidence of the prevalence of the tactic.
The force said scammers aim to create panic so victims act quickly without stopping to think. That pressure links fake bank alerts, parcel messages, billing notices and malicious software prompts, even though the incidents documented by the different sources are not shown to share the same operators.
The pattern is not one confirmed campaign. It is a set of separate findings showing how phishing can move through domains, brands, messaging services, telephone numbers and software installation.
