X says attackers may be targeting accounts because its X Money payments service is now more widely available.
The company is investigating a wave of unsolicited password-reset emails sent to users. While their arrival alongside the wider X Money rollout has fueled account-takeover concerns, X says it has found no evidence of a breach or successful account takeovers so far.
X users began reporting unexpected password-reset emails and codes on September 1. In a public post, X product engineer Mridul Singhai said:
“Attackers appear to believe that, now that @XMoney is widely available, they can gain unauthorized access to accounts.”
Singhai said X was actively investigating, apologized for the repeated emails, and added that the company had found “no evidence of any breaches.”
X Money gives eligible US users access to financial services within X, including interest-bearing accounts, a Visa debit card, and peer-to-peer payments. Cross River Bank provides the banking infrastructure behind the service.
This could make some X accounts more attractive targets, particularly accounts with payment access, high follower counts, business use, or valuable social-engineering potential.
The activity itself appears consistent with attackers submitting password-reset requests in bulk against X accounts. Requesting a password reset is not the same as resetting a password, however, and neither automatically means that an account has been taken over. X’s recovery process requires access to the email address or phone number associated with the account before someone can complete the reset.
There is no evidence that anyone has accessed X Money accounts or funds. Nor has X confirmed that X Money caused the password-reset activity. The timing is notable, but it does not prove a technical connection between the two.
Earlier this year, we saw a flood of Instagram password-reset emails, showing that similar activity can happen on platforms without payment services.
It could be a cover for something more serious. Even if an attacker cannot complete a reset, large volumes of legitimate-looking reset messages can provide useful cover for scams.
Reset flooding can also be a nuisance tactic. Repeated messages may pressure someone into changing their password unnecessarily, obscure more important security notifications, or encourage them to disable security controls in an attempt to stop the alerts.
How to stay safe
If you receive an X password-reset email that you did not request:
Do not click links or enter codes from unexpected messages. Open the X app or type x.com into your browser yourself if you want to inspect or change account settings.
Do not share reset codes or two-factor authentication codes. Support staff, advertisers, and “security teams” will not contact you unexpectedly to ask for them.
Turn on password-reset protection. X says this setting requires additional account information, such as an email address or phone number, before it will send a reset link or code. It is available under Settings and privacy > Account > Security > Password reset protection.
Use two-factor authentication, preferably an authenticator app or security key where available. This adds another verification step if someone obtains or guesses your password.
Use a unique, strong password. If you use your X password anywhere else, change it through X’s settings, not through a link in an email.
Watch for signs of an actual account takeover. These include unfamiliar posts, direct messages, profile changes, login alerts, or unknown apps connected to your account.
Stay alert for phishing. The strongest immediate consumer risk may not be a flaw in X itself, but phishing that imitates the reset process. A fake message can look especially convincing when genuine reset emails are arriving around the same time.
Use protection. An up-to-date, real-time anti-malware solution with web protection can warn you about malicious and fraudulent sites.
If you’re unsure whether a message is real, use Malwarebytes Scam Guard to check it and get advice about what to do next.
Scammers don’t need to hack you. They just need you to click once.
In a tech support scam, criminals pretend to work for a trusted technology or security company. They claim there is a problem with your device, software, subscription, or account, then try to persuade you to pay them, share personal information, or give them remote access to your computer.
These scams used to rely mainly on browser locks and fake virus warnings. Now, scammers use many more ways to reach people, including websites and platforms they trust.
Once someone makes contact, the scammers may demand payment, ask for personal information, or try to persuade them to install remote access software.
Beware of someone wanting to connect to your computer remotely. One of a tech support scammer’s most powerful weapons is the ability to connect remotely to a victim’s computer. If you allow this, the scammer may gain access to all of your files, folders, and the information they contain.
Tech support scams impersonating Malwarebytes
Tech support scams affect Malwarebytes directly because scammers often impersonate trusted security companies, as in the example below.
You can tell it’s not the real Malwarebytes when:
They use a name other than Malwarebytes. Malwarebytes does not outsource its support. We have our own Support team and do not authorize third parties to provide support using our name, logo, or any other intellectual property.
They can’t or won’t accept payment by credit card. Malwarebytes uses a credit card processor for all transactions. Credit card processors screen the companies they work with for risks such as fraud and abuse. Credit cards also offer consumer fraud protections, so it is a red flag if a company tries to steer you toward another payment method.
They make unsolicited support calls. Malwarebytes does not do this. Tech support scammers may buy personal information from data brokers that have identified people as potentially vulnerable targets. But how would a legitimate company know that you have a problem with your computer—or even that you own one? If someone calls out of the blue claiming that your computer has a problem, hang up.
What to do if you’ve been scammed
If you’ve fallen victim to a tech support scam, here are a few steps you can take:
Have you already paid? Contact your credit card company or bank and let them know what’s happened. You may also need to file a complaint with the FTC or contact your local law enforcement agency, depending on your region.
Did you share your password with the scammer? Change it on every account that uses the same password. Consider using a password manager and enabling two-factor authentication (2FA) on important accounts.
Scan your system. If scammers have accessed your computer, they may have installed a backdoor that allows them to return later. Malwarebytes can remove backdoors and other software left behind by scammers.
Keep an eye out for unexpected payments. Look for suspicious charges or payments on your credit cards and bank accounts so you can dispute them quickly and prevent further losses.
Be wary of suspicious emails and text messages. Scammers may now see you as a potential target and try other methods to defraud you.
How Malwarebytes is fighting tech support scams
Malwarebytes researchers actively fight tech support scams in the US and overseas. They work closely with the Federal Trade Commission (FTC), providing technical evidence to help shut down tech support scammers and educating internet users about the latest tactics and how to protect themselves.
Scammers are becoming more strategic about where they target people.
Nine in ten toll scams—the fake unpaid-toll messages that threaten fines or license suspension—arrive by email or text, while roughly six in ten romance scams show up first on social media. That’s no coincidence. Rather than blasting the same message everywhere, criminals are tailoring different scams to the platforms where they’re most likely to succeed.
This finding comes from Malwarebytes’ own threat research systems and draws on global data between April 15 and July 14, 2026. The research reveals the various ways scammers are adapting their tactics and provides new insights about where they show up, when they strike, and which brands they impersonate.
Here’s a look at the key takeaways.
Every scam has a preferred platform
You’re far more likely to receive a fake giveaway scam via a social media feed than you are by email or text. On the other hand, half of all IRS scams will come via a phone call. Malwarebytes measured more than 20 different types of scams, ranging from tech support and refund scams to sextortion and scareware, and found that each one favors a specific platform.
Intuitively, the platforms favored often match the content of a scam—job scams mostly arrive through typical work channels like email, romance scams mostly arrive through social media where meeting strangers is least questioned, and tech support scams mostly arrive through the phone. The channel can also shape how the scam feels: A DM can feel personal, while a phone call creates pressure to respond in the moment. And prior research shows that scammers often repeat what works, which might explain why they keep doing what they’ve been doing so far.
The web still wins
Despite the rise of social media and messaging apps, scams are reaching us through the web more than any other platform, followed by email and SMS.
No surprise that the web is the most popular doorway. Malwarebytes blocks around 500,000 phishing websites a day.
MrBeast beats Trump
He’s already the most popular YouTuber in the world, famous for his online antics and extreme stunts, but Malwarebytes data shows that “MrBeast” can now add “most impersonated person” to his resume, handily beating Elon Musk and Donald Trump (numbers two and three, respectively).
MrBeast, whose real name is Jimmy Donaldson, is the go-to favorite for scammers looking to piggyback on his fame by using his likeness in some 30% of impersonation scams, ranging from crypto giveaways to transfer fee swindles. Familiar faces lower the public’s guard and make scam messages feel more credible, which is why they work so well. So, the next time MrBeast shows up in your feed asking you to send cash as part of a verification process, watch out.
12:00 pm ET is the “golden hour” for scammers targeting Americans
If you’re on the East Coast in America, lunchtime is also scamming time. Malwarebytes data shows that high noon is the golden hour for scam texts, and it’s roughly 874% busier than the quietest time, which is 1:00 am ET.
Scam texts peak on Fridays
The rate of scam texts hitting your phone builds throughout the week. From a low on Sunday, they increase steadily in frequency and hit their peak on Fridays. So by the time you’re leaving work and preparing for the weekend, you’re also getting hit with roughly 50% more fraudulent text messages than you were when the week began. The data doesn’t tell us why, but it does suggest scammers are deliberately timing their campaigns rather than sending messages at random.
Big brands are big business for scammers
The world’s biggest brands are also some of the most useful to scammers. They’re instantly recognizable, used by hundreds of millions of people, and already part of our everyday lives, making them a natural fit for everything from fake offers to bogus account alerts. Based on reports from Malwarebytes users, the five most impersonated brands are:
Google
Microsoft
Apple
Roblox
Amazon
According to Malwarebytes users, Google’s brand name was abused at least twice as often as Amazon.
Gaming is becoming a bigger target
Scammers are increasingly targeting gaming communities. According to data collected by Malwarebytes Scam Guard, about half of all gaming scams can lead to a financial hit of $1,000 or more, what we term a “high-severity risk.” The most impersonated gaming sites were Roblox, Steam, Discord, and Minecraft. Roblox saw a 15% spike in scam activity from mid-June to mid-July, while Steam saw a 19% spike over the same period.
How to spot and stop scams
The data points to a scam economy that’s becoming more specialized. Rather than relying on one-size-fits-all campaigns, criminals are tailoring scams to the platforms we use every day, from email and text messages to gaming communities and social media. The tactics may change, but the goal stays the same: to earn your trust long enough to steal your money or your information. Knowing how those tactics vary from platform to platform makes them easier to recognize, and easier to avoid.
In general:
Do not click links or call phone numbers in unsolicited emails, text messages, or social media DMs.
When in doubt, check the legitimacy of the message by going directly to the company’s official website and asking about it through official channels. Don’t follow sponsored search results to get there—these can be scams.
Do not give out personal details, PINs, passwords, payment information, or verification codes during an unsolicited call. Legitimate companies will not ask for passwords or verification codes over the phone. Hang up and call back through the organization’s official phone number.
Use a browser extension that blocks scam and phishing sites, such as Malwarebytes Browser Guard. It can flag a fake storefront before you land on it, including ones it hasn’t seen before.
Install a mobile security product like Malwarebytes Mobile Security that filters out scam and spam text messages.
Check if a message is legitimate. Malwarebytes Scam Guard can check a message, phone number, or link against its expansive threat intelligence database to determine if it is malicious or safe. It then provides information on red flags and any next steps you should take. Scam Guard flags approximately one in five analyzed sessions as high-risk—situations that could result in significant financial losses ($1,000 or more) or personal harm.
Methodology
The data in this report comes from Malwarebytes proprietary threat research systems, collected between April 15 and July 14, 2026. All data is anonymized and reflects what Malwarebytes is able to observe through its own infrastructure.
This report is also available to read in PDF format.
To subscribe to my monthly email newsletter, you have to enter your information on the webpage, and then reply to an automatically generated email. This is, of course, to prevent people from subscribing addresses other than their own.
Starting last weekend, I have been receiving a lot of individual responses to those emails. Always one line:
Thank you for the positive impact your emails have had on my life.
Your emails are a game-changer.
Your emails are a constant reminder of why I subscribed.
Your emails rock.
Thank you for the time and effort you put into creating these informative emails.
Thank you for the passion and enthusiasm you infuse into your email content.
Your emails consistently exceed my expectations. Thank you for the exceptional value!
I responded to the first few, because sometimes I do get these nice emails from readers and I hadn’t yet realized it was all fake. But so many, and all at once—this is obviously AI. And obviously a scam, except I can’t figure out what the scam is.
All Gmail. None of the addresses has actually subscribed to Crypto-Gram. They could; whoever is sending the emails could easily have confirmed the subscription.
My first thought was pig butchering—wanting me to respond and turn this into a conversation—but no one has responded to any of my responses. Anyone have any idea?
The site we examined this week looks like a GTA 6 fan countdown site but offers to sell a leaked copy of the game. It loads a wallet drainer the moment you arrive: code designed to steal cryptocurrency and other assets from connected wallets. Choose to pay with cryptocurrency, and the drainer asks you to connect a wallet. It can target assets across several blockchain networks.
What the page looks like
The disguise works because much of the page uses accurate-looking information. There is a live countdown to November 19, a map of Leonida, and a grid of release facts and gameplay tiles. The release details match Rockstar’s own announcements: GTA 6 is scheduled for November 19 on PlayStation 5 and Xbox Series X|S, and Rockstar has not announced a PC version.
Two offers sit among that accurate material. One sells a leaked copy for $50. The other offers the same thing for cryptocurrency: 1 SOL (worth about $102 at the time of writing).
The page then tells visitors that every other site offering leaked material is a scam and this one is the only safe place to buy. Warning visitors about other scammers is a common technique designed to reassure anyone who is already suspicious.
The site also contradicts itself in ways anyone can check. Its footer states that the page offers no purchase, download, or payment of any kind, directly beneath two payment buttons. The signup box is headed “Get notified. Not scammed.” The facts grid says the game is console-only, while the FAQ promises a PC download after purchase, and claims no price has been confirmed, months after Rockstar opened pre-orders in June.
The writing splits in two as well. The countdown and map sections are clean copy. The sales copy contains multiple errors, including a misspelled “download” and a reference to GTA IV rather than VI. Our reading is that a legitimate-looking fan template was reused and the sales pitch added by someone else who did not proofread it.
What happens when you connect a wallet
There are two pieces of code here, and they are very different.
The first is written into the page and targets a Solana wallet. It does not charge the advertised price. Instead, it checks the wallet’s balance, leaves a small amount to cover the transaction fee, and prepares to transfer everything else to the attacker. The advertised price plays no part in the calculation.
The second is a separate script of around 2.4 MB, and it is far more capable. It includes a legitimate, widely used tool for connecting websites to cryptocurrency wallets, allowing it to work with many wallets rather than just one. Added to that tool is malicious code that inventories the connected wallet, calculates what its assets are worth, reports the details to the attacker, and retrieves transactions for the victim to approve.
The script is configured to target wallets across seven blockchain networks: Ethereum, Polygon, BNB Smart Chain, Avalanche, Arbitrum, Base, and Fantom. It recognizes major stablecoins on those networks and can request several kinds of access. Depending on what the victim approves, it could transfer cryptocurrency immediately or gain permission to move tokens and entire NFT collections later.
A transfer takes assets immediately. An approval can give the attacker access to them later. This script supports both.
It checks where you are first
Before asking the visitor to connect a wallet, the script downloads its settings from the operator’s server. If a particular setting is enabled, it uses the visitor’s IP address to identify their country and checks it against a fixed list: Armenia, Azerbaijan, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Tajikistan, Turkmenistan, and Uzbekistan.
Visitors from those countries see “This website is unavailable in your region” and are redirected to a blank page. Everyone else continues.
The setting that controls this country-blocking feature is named CIS_Protection in the code.
Excluding this group of countries is a long-standing convention in some criminal tooling, usually interpreted as an attempt to avoid local law enforcement. We would not draw conclusions about who is behind this from a country list alone. What it shows is that whoever built the tool made a deliberate decision about who they were willing to rob and wrote that decision into a settings file.
It works out what your wallet is worth
The script profiles visitors before asking them to approve anything. It checks their holdings across different blockchains, calculates their total value, and sends the details to the operator. These include the wallet’s estimated dollar value, its tokens and NFTs, the visitor’s IP address and country, and how many times the wallet has connected.
The script is also designed to make analysis more difficult. It can detect the automated browsers used by security scanners, suppress messages that would normally appear in the browser’s developer console, interfere with developer tools, and conceal its server addresses inside the code.
Several details suggest that the drainer is rented rather than homemade. The Solana address written into the webpage does not appear in the larger script. Instead, the script downloads an operator ID and settings from a remote server, which also prepares the transactions shown to victims. This resembles a hosted service used by multiple customers, although we cannot identify the product. It also allows the destination of stolen funds to be changed without altering the website.
The fake GTA 6 sites we investigated in June asked victims to send a fixed payment, limiting the immediate loss to that payment. This site can try to take everything in the connected wallet. Depending on what the victim approves, the attacker could either transfer the wallet’s current balance immediately or gain permission to take tokens and NFTs later.
What to look for before you approve anything
Simply connecting your wallet does not allow the site to take anything. The danger comes when you approve the transaction or permission request that follows.
That approval screen is an important last line of defense. The Phantom crypto wallet, for instance, says that it simulates every transaction before you sign and shows a plain-language preview of what will happen, including a warning if something looks suspicious. Other reputable wallets do the same, but they cannot protect you if you approve a request without reading it.
Check the wallet’s approval screen for two warning signs. First, reject any transaction that would transfer all or nearly all of your balance instead of the price you expected to pay. Second, reject any request to approve, allow, or grant access to your tokens or NFTs. That could let the attacker move those assets later, and a shop selling a game has no reason to request such permission.
How to protect yourself
Nobody is selling a playable copy of GTA 6 yet. Rockstar is selling pre-orders for a November 19 release. Any site offering a leaked, early, or playable copy is not an authorized seller.
Treat a wallet connection request on a game site as a stop sign. Legitimate GTA 6 purchases are available through Rockstar’s authorized stores and retailers. Rockstar does not ask buyers to connect a cryptocurrency wallet or send cryptocurrency to a wallet address.
Read the approval screen every time, and reject anything that moves close to your entire balance or asks for ongoing access.
Don’t let the accurate parts vouch for the rest. A correct release date and real artwork cost an attacker nothing.
Keep large balances out of the wallet you browse with.
Block the pages before they load.Malwarebytes Browser Guard is free and blocks scam and malicious sites while you browse.
What to do if you connected a wallet
Review and revoke any permissions granted through the site. These permissions may allow the attacker to take assets later, even if nothing has been stolen yet.
Disconnect the site from your wallet to end the current connection. This does not cancel any permissions you have already granted.
Check the wallet’s full contents, including tokens and NFTs on every chain you use.
If funds have been taken or you entered your recovery phrase, move anything of value that remains to a newly created wallet.
Report the receiving address to your wallet provider and a public scam-reporting service. This may help providers identify the address and warn other users.
Be wary of anyone offering to recover stolen cryptocurrency for a fee. This is often a second scam aimed at the same victim.
A completed transfer cannot be reversed. The code we analyzed does not request or expose the wallet’s recovery phrase, so connecting to the site alone doesn’t compromise that phrase. If you entered it anywhere during the process, treat that as a separate compromise and move your remaining assets to a newly created wallet. Any permissions you granted remain active until you revoke them.
Remember
The lure has not changed since June. It’s still a promise to play GTA 6 before Rockstar releases it, and that promise is still impossible to keep.
What has changed is what sits behind it. One approach charged a price. Another stole passwords. This one asks for approval to access wallets using a tool built to be rented, reconfigured, and pointed at whatever people are excited about next.
GTA 6 is scheduled to arrive on November 19, 2026, through the same stores gamers already use. No unauthorized playable copy before launch should be treated as legitimate.
Recently, we found a listing on BuzzFeed from someone pretending to be Malwarebytes Support. It reminded us why we need to be cautious about content on platforms where anyone can create an entry.
Based on the phone number, we suspect the people behind this listing are trying to draw callers into a tech support scam. The scammer may use social engineering to persuade victims to grant remote access to their devices.
This is not Malwarebytes’ phone number
At first glance, this kind of lure can look convincing. It borrows the familiarity of a well-known publication, uses a recognizable security brand, and may appear in an ad placement or search result where people expect to find legitimate information.
But the combination of a trusted platform and a trusted brand does not make something trustworthy.
The phone number in the listing has also been used in similar scams impersonating McAfee and Norton.
Scammers do not always need to build a convincing website from scratch. They can use platforms that let people create listings, ads, storefronts, pages, reviews, or posts, relying on the platform’s reputation to do part of the work for them.
How scammers borrow a platform’s credibility
The whole point of online marketplaces and social media is to make it easy for people to create posts and listings.
Someone wants to sell an old camera, a handcrafted item, a digital product, or perhaps offer a service. They create an account, fill out a form, add a few photos, write a description, and make their listing visible to a huge audience.
You can imagine how attractive this is to scammers.
Our own research found that 47% of people encountered scams on social media at least once a week, while 36% encountered them on buying-and-selling platforms.
A fake listing can borrow credibility from:
The platform’s familiar design
Its domain name and security certificate
The assumption that listings have been reviewed
Brand names and logos used without permission
Ratings, reviews, or sales claims that look legitimate at first glance
The scammer does not need to persuade victims that an unfamiliar domain is safe. They only need them to believe that content hosted by a marketplace, classified site, social-media platform, advertising network, or review site is safe.
People are rightly cautious when they land on a random website with an odd name. But they may lower their guard when they see a familiar marketplace or media brand in the browser address bar.
Many marketplace scams are straightforward. A seller advertises a product that does not exist, sends a counterfeit item, or tries to persuade the buyer to pay outside the platform.
From listing to scam
But some listings are only the beginning of the scam.
A listing might advertise:
Antimalware software or a “lifetime” security subscription
Device-cleaning or PC-repair services
Account-recovery help
Printer, router, smart-TV, or smartphone support
A low-cost or free trial that requires victims to call a number
A product description containing a “support” phone number or an external link
The product or service being advertised is irrelevant. The real purpose is to get victims to call a number, visit another website, install remote-access software, or hand over payment details.
How to stay safe
Large platforms do try to remove fraudulent listings. They use automated detection, seller controls, user reports, brand-protection programs, and moderation teams.
But platforms operating at scale face a difficult problem: legitimate users can create an enormous number of listings, posts, ads, and product pages in a short time. Review systems can miss malicious content, particularly when scammers change names, images, wording, accounts, phone numbers, and links faster than moderators can respond.
Users therefore need to take precautions:
Be suspicious of listings offering security software, technical support, account recovery, or device repair at an unusually low price.
Treat unexpected phone numbers in ads, listings, product images, comments, and pop-ups as untrusted, especially when they appear in an unrelated category. Our example appeared in the “Quizzes” section of BuzzFeed.
Do not assume a listing is genuine because it appears on a large, familiar platform.
Before engaging, check the seller’s history, reviews, contact details, and return information, bearing in mind that these can also be manipulated.
Avoid sellers who pressure you to continue the conversation off-platform.
Never allow an unsolicited “support agent” to access your computer remotely.
Do not pay with gift cards, cryptocurrency, wire transfers, or payment apps. Use a payment method that offers purchase protection and may allow you to dispute an unauthorized or fraudulent charge.
Type the company’s official website address into your browser, use its official app, or rely on a saved bookmark. Verify any support number through one of these official channels.
Report suspicious listings to the hosting platform and to the impersonated brand.
If you have already called a scammer or granted remote access:
Disconnect the device from the internet
Remove remote-access software
Change important passwords from a known-clean device
Contact your bank or card provider if any payment details were shared
The rule of thumb is simple: a trusted platform can host untrusted content. Scammers thrive on borrowed credibility.
Pro tip: Use Malwarebytes Scam Guard to help you figure out whether something is a scam and what to do next.
Our Support team is available 24/7 to help with anything from quick questions to complex issues. Visit help.malwarebytes.com to contact us directly or search our knowledge base.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
iPhone users are being targeted in a new tech support scam, using a fake Apple Pay notification to trick users.
Tech support scams that use fake warnings to push victims into calling a phone number have been around for years, but this page has been designed specifically for phones.
Instead of a desktop warning claiming your computer has a virus, the scam imitates familiar iPhone features in an attempt to scam you.
What happens
A page opens on your phone and appears to show Apple Pay processing a $657 App Store payment. A spinner turns. “Face ID · verifying identity” appears beneath the amount. There is a transaction ID, a padlock, and all the visual cues of a payment in progress.
A few seconds later, the story changes.
You get an alert saying your Apple ID is locked because of an unrecognized sign-in. A phone number appears under the instruction to call Apple Support immediately. When you open the transaction details, the payment is marked “Completed.” Then your phone begins speaking an alert about the unauthorized charge.
It’s all completely made up.
The page we analyzed contains no real Apple Pay transaction and no biometric verification. Instead, it uses hardcoded payment details, browser-generated speech, fake security warnings, and aggressive navigation tricks to get the victim to call the scammer.
The “Face ID” check isn’t real
The first screen is designed to make it look as though the phone itself is authorizing a payment.
In this sample, “Face ID · verifying identity” is simply an HTML element displayed beside an icon. There is no Apple Pay request and no biometric-authentication call behind it.
Apple Pay can legitimately be used on websites, but a genuine payment begins when the merchant requests it. The system then immediately displays a payment sheet for the user to review and authenticate, as Apple’s guidelines specify.
Nothing like that happens here. The scam page has simply drawn its own imitation.
The “Processing payment” spinner is equally cosmetic. The entire splash screen disappears on a timer after 2.8 seconds, regardless of anything the user does.
The receipt is fake, and the code is the same for everyone
The next screen is dressed up as a transaction receipt. It contains an amount, masked card digits, an authorization code, a transaction ID, and a green “Completed” status.
Most of those values never change.
That’s because the page hardcodes the amount as $657.00, the transaction ID as AP-2026-08-03-14:32, and the authorization code as AUTH-8F3A2B1C. Every visitor is shown the same values.
The date, however, is generated dynamically.
JavaScript calls new Date() and formats it with toLocaleString(), meaning the receipt uses the current date, time, and timezone from the victim’s device.
That creates an obvious contradiction. The fixed transaction ID contains 2026-08-03, while the date field shows the time and date when the victim happens to open the page.
A genuine transaction doesn’t rewrite its transaction date every time somebody looks at it.
The “voice alert” is generated by the browser
Once the victim opens the transaction details, the page attempts to speak:
“Unauthorized charge of six hundred fifty seven dollars from your Apple ID. Please call support immediately.”
There is no recorded Apple message behind it.
The JavaScript creates a SpeechSynthesisUtterance and sends it to window.speechSynthesis, the browser’s built-in Web Speech API to read the warning aloud.
Using a text-to-speech voice already available on the victim’s own device is a clever social-engineering touch. The warning may sound more like part of the phone itself than audio playing from a random website.
The page tries to make leaving difficult
One interesting part of this scam is the code surrounding the exit routes.
The page adds a new browser-history entry and listens for popstate, allowing it to react when a victim tries to navigate backward. It then displays a warning claiming that closing the page could expose the victim’s payments and banking information.
If the victim accepts the prompt to call support, the code navigates to a tel: URL containing the scam number. If they cancel that particular prompt, another warning appears and another history entry is added.
The page also registers handlers for beforeunload, pagehide, the context menu, an edge-swipe gesture, and common keyboard navigation shortcuts. On iOS, its pagehide handler even makes a delayed attempt to navigate directly to the telephone number.
These tricks can make the page persistent and annoying, but they don’t lock the browser or device. Modern browsers restrict what websites can do during navigation. For example, beforeunload isn’t reliably triggered on mobile, generally requires prior user interaction, and can only produce a generic browser-controlled confirmation.
In other words, the code tries several ways to stop you leaving or get you to call, but it can’t take control of the browser itself.
The phone call is the real objective
The $657 charge is bait to get you on the phone.
The support number appears prominently on the page, the red “Verify now” button points to it, and the fake security prompts repeatedly offer to dial it.
This is a well-established tech support scam tactic. The FTC warns that scammers use bogus charge notices to get victims to call, then may request remote access or pressure them into sending money through gift cards, bank transfers, cryptocurrency, or payment apps.
Apple also warns that scammers may claim someone has broken into your Apple account or made unauthorized Apple Pay charges, using urgency to stop you from contacting Apple independently.
What to do if you see a page like this
There is a simple clue worth remembering:
A security pop-up that manufactures an emergency and tells you to call the phone number displayed on the screen should be treated as a scam.
If an Apple Pay–like interface appears inside a website, remember that visual resemblance proves nothing. A site can freely mimic buttons, locks, logos, transaction IDs, and even animated spinners. What matters is whether a genuine Apple Pay payment sheet has actually been invoked.
In this case, it hasn’t. The important part of this scam is not the fake $657 payment. It is the urgency built around it to get the victim onto a call.
Don’t tap OK, Call, or Verify. Anything you tap on the screen will either call the number or bring up another warning.
Don’t dial the number, and don’t call it back later to complain or to check.
Close the tab using your browser’s tab switcher. On iPhone or Android, open the tab switcher and swipe the tab away. Once the tab is closed, the scam page can no longer keep you there or try to make the call.
If a dialog appears asking whether to leave the site, choose Leave. Web pages can ask you to stay, but they cannot stop you from leaving.
If in doubt, check your real purchase history. Open the App Store or Settings on your device and review your Apple purchase history. If there’s no $657 charge there, there was never a charge.
If you already called and gave someone remote access to your device, take action immediately:
Disconnect from the internet
Uninstall any remote access software they had you install
Change your Apple ID password and your bank passwords from a different device
Contact your bank about any payments you sent.
Check if something is a scam
If a number like this one is on your screen or already in your call history, check it before you do anything else. Malwarebytes Scam Number Check is a free way to see whether a number has been linked to scam activity. Just put the number in and we’ll tell you if it’s likely to be a scam.
Got a screenshot or URL of a suspected scam? Upload it to Scam Guard—built in to Malwarebytes Mobile Security—and you’ll get a verdict and safety tips in seconds.
OpenAI disrupted a social engineering group from Cambodia that used ChatGPT. Its scope is impressive:
The network simultaneously conducted multiple types of scams, often blending elements from different schemes. For instance, operators used dating personas to build trust before introducing fraudulent investment opportunities involving cryptocurrencies and spot gold trading. Other users engaged in lengthy romantic conversations with targets using fictitious identities, posed as representatives of online gambling platforms offering fake bonuses and winnings, or impersonated law enforcement agencies to tell targets they needed to pay fines for committing serious criminal offenses.
Although the narratives varied, users across the network consistently displayed the same underlying pattern of deceptive behavior. For example, they created and operated fake dating profiles, fictitious investment experts, and fraudulent law enforcement personas. They also generated images of forged documents, including passports, legal notices, stock-purchase confirmations, and gambling platform interfaces.
From several independent reports, we’ve seen evidence of scammers using fake Android “interview” apps to target job seekers on the Indeed platform.
Indeed is one of the world’s largest employment websites, giving scammers access to a huge pool of potential victims, especially in a competitive job market.
What we found
A user in the UK posted on our forums after being instructed by a supposed employer on Indeed to install an “Interview App.”
A user in Brasil submitted an anonymized report after receiving similar instructions to install an APK named MyInterview from a link shared during a job interview.
Meanwhile, Reddit users discussed a “Indeed Interview” app that allegedly completely compromised one user’s phone.
The victim who installed the MyInterview APK said their phone began closing apps by itself after installation. They also shared a screenshot showing MyInterview listed under Android’s downloaded Accessibility services.
Common lures used by the scammers include:
“Complete your interview by installing the Indeed app.”
“Update your Indeed application.”
“Identity verification required.”
“Download our recruitment portal.”
“Salary agreement available after app installation.”
An analysis by Malwarebytes Android Malware Researcher Nazeeh Sulaiman showed that these Android apps impersonate Indeed’s login page before creating a VPN connection after an applicant enters an email address. Static analysis identified the apps as Trojan.Droppers, capable of installing additional untrusted apps.
At the time of writing, the final payload was spyware, although we initially expected a banking Trojan. Once the malware is granted the Accessibility permission, it effectively takes over the device. The interesting thing here is that it can prevent users from uninstalling the malicious app. When the user taps Uninstall in Android Settings, the malware simply forces the screen back, preventing removal.
How it works
Scammers advertise fake job openings on Indeed and lure applicants into installing a fake Android app that impersonates Indeed and present itself as an interview tool.
After confirming their application, job seekers receive instructions like these:
In this example the job seeker is instructed by a “recruitment firm” to download and install the app, connect to the VPN, create an account, and enter an invitation code. They are then told to keep the app open while waiting for confirmation.
This malicious app is not affiliated with Indeed. The company’s official Android app, Indeed Job Search, is distributed through Google Play, not through an APK supplied in a recruitment message or an unfamiliar interview website.
The interview process on Indeed does not require applicants to install a separate app, confirmed by an Indeed spokesperson:
“Interviewing through Indeed’s platform happens entirely in a browser and never requires downloading a special app. Any message asking a job seeker to download an app to participate in an interview is not legitimate. We encourage job seekers to avoid clicking links or downloading files from any message directing them to do so.”
It’s worth pointing out that the dropper is not necessarily the final payload. It’s an initial-stage app intended to install another malicious or unwanted app onto the device, often after bypassing a victim’s caution with a seemingly legitimate pretext. Even if the fake Indeed app does not visibly steal data itself, it can serve as a delivery mechanism for more dangerous malware.
A VPN connection is perfectly legitimate in many situations, but there is no obvious reason for an interview app to create one immediately after an applicant supplies an email address.
In a malicious workflow, a VPN can give an app substantial influence over the device’s network traffic. It may allow attackers to route communications through systems they control, hide what the app is doing, or support later stages of the attack. The VPN behavior alone does not prove that traffic was intercepted or modified, but combined with brand impersonation and dropper functionality, it is a serious warning sign.
The fake app’s presence in Accessibility settings is also concerning. Accessibility services can view screen content and perform actions of behalf of the user, making them attractive to malware developers. In the screenshot supplied to us, MyInterview was disabled, so there is no evidence the service was active on that device. Nevertheless, its presence as a downloaded Accessibility service is relevant to the overall risk assessment.
How to stay safe
A job interview should not require you to sideload an Android app, enable a VPN connection, or install software from an unknown source.
In this campaign, the supposed interview app is simply the lure: it impersonates Indeed, establishes a suspicious network connection, and is designed to deliver additional malware.
Before using any recruitment platform, make sure you understand its hiring process and be suspicious of requests that deviates from it or move you to another platform.
Don’t install apps just because someone tell you to, especially if you have to especially if you have to install them outside Google Play.
Verify job offers through independent channels. In some of the reported cases, the companies either did not exist or not have offices in the cities where they claimed to be hiring.
The Indeed spokesperson added:
“Job seekers are at the heart of everything we do, and their safety and trust are a top priority. We are aware of scams involving individuals instructing job seekers to download an app to complete a virtual interview. These are in no way affiliated with Indeed, and we strongly condemn bad actors who exploit the trust job seekers place in our platform and brand.
For more on how to verify a legitimate Indeed app and spot the warning signs of a fake one, visit our Help Center.”
Phishing pages don’t need to be sophisticated. They just need to look convincing enough to make you trust them.
TikTok phishing often starts with an email or message designed to make you think you need to act on your account. It might claim your account has been suspended, reported, or hit with a copyright violation, or tell you that you’re eligible for verification.
The link might take you directly to a page made to look like TikTok’s login screen. If you enter your information, it can be sent straight to the scammers, including your phone number or email, password, and potentially a one-time authentication code.
With access to your account, scammers could impersonate you, target your contacts, or try to use the same password to break into your other accounts.
What to do if you get a suspicious TikTok message
If you get an unexpected email or message telling you to log in to TikTok, don’t use the link it provides. Open the real TikTok app or go directly to tiktok.com instead and check your account there.
If you’ve already entered your login information on a suspicious page, change your TikTok password immediately and check for any devices or login activity you don’t recognize.
Fake warnings and verification offers
Not every TikTok phishing link leads directly to a fake login screen. Some try to scare you with claims that your account has been suspended or reported, or that you’ve received a copyright or community-guidelines strike that needs “resolving.” Others offer something you might want, such as a verified badge, creator payout, or brand deal.
For example, a fake TikTok Verification Center might congratulate you on your performance and tell you that you’re eligible for a verified badge:
Another fake verification page asks for account information as part of a supposed verification request:
Whether the message threatens you with a problem or promises you a reward, the aim is the same: to persuade you to interact with a fake TikTok page and hand over information.
Why these TikTok scams work
Fake TikTok pages can look convincing because copying the appearance of a real website is relatively easy. But the story that gets you there is just as important.
Suspension and copyright warnings create urgency. Verification and monetization offers create an incentive. Both give you a reason to act quickly instead of stopping to check where the link has actually taken you.
How to protect your TikTok account
Don’t use links in unexpected emails or messages asking you to log in to TikTok. Open the TikTok app or go directly to tiktok.com instead
Treat any message about a suspension, strike, or verification eligibility as unverified until you’ve confirmed it inside the TikTok app itself
Check the address bar before entering your login information. Make sure you’re actually on tiktok.com—a fake page can look almost identical to the real thing
Use a password manager where possible. It won’t auto-fill your TikTok password on a different domain, which is a useful warning sign
Turn on two-factor authentication (2FA) on your real TikTok account so a stolen password alone isn’t enough to get in
If you’ve already entered your login information on a page like this, change your TikTok password immediately and check for any login activity or devices you don’t recognize
GTA 6 footage really has leaked online, and Rockstar has an official Extended Look coming to Netflix on August 27. But cybercriminals are exploiting the hype with fake Rockstar sites that lead visitors to password-stealing malware.
We identified a network of sites appearing in searches for a GTA 6 demo and impersonating Rockstar Games. One Google result advertises an “Official Download,” but visitors who follow the sites’ “Play Now” links can instead end up downloading gta6_installer.exe.
The sites are particularly convincing because they copy Rockstar’s genuine promotion for its August 27 extended look at GTA 6. But the executable they deliver isn’t a demo, game, or video. It’s an information stealer designed to take passwords stored in browsers, cookies, and authenticated sessions. And because stolen browser sessions can sometimes be reused without going through the normal login process, even two-factor authentication (2FA) may not be enough to stop them.
One of the fake GTA 6 demo websites impersonating Rockstar Games
There is no GTA 6 demo
Rockstar has not announced or released a demo of Grand Theft Auto VI.
The game is scheduled for release on November 19, 2026, for PlayStation 5 and Xbox Series X|S. Rockstar has not announced a PC version.
Rockstar has announced an extended look at GTA 6 for August 27, premiering on Netflix before appearing on its YouTube channel later that day. That’s something to watch, not a playable demo or game download.
The scam sites copy this genuine announcement while using “Play Now” buttons that can lead visitors to the malicious executable.
The site copies Rockstar’s genuine Extended Look promo, but adds a fake “Play Now” button
In other words, there is no legitimate GTA 6 demo or PC build to download. This isn’t the first fake GTA 6 offer we’ve seen. Earlier this year, scammers were charging people hundreds of dollars for fake GTA 6 early access.
The file size should also immediately raise suspicion. The executable delivered by these sites is just 1.1 MB. That is nowhere near enough to contain a modern AAA game. In fact, the screenshot we took of one of the websites is larger than the file it was offering.
The supposed GTA 6 installer is just 1.1 MB
The leak created the opening
On August 18, new GTA 6 gameplay footage and what appears to be a complete map of Leonida, the game’s setting, began circulating online. A person or group calling itself Cyberleek claimed responsibility.
Rockstar and Take-Two responded with takedowns, with Take-Two filing DMCA subpoenas seeking records from Microsoft and Discord that could help identify whoever is behind the leaks.
The malicious gta6_installer.exe sample was first spotted on August 19, just one day after the first Cyberleek material began circulating.
Apparently genuine unauthorized GTA 6 material was already circulating, giving people searching for leaked footage, maps, or unofficial builds reason to believe there might be more out there.
But genuine leaks weren’t the only thing competing for that attention. Leaked clips carried promotional material for a cryptocurrency token associated with Cyberleek, while Cyberleek’s website solicited cryptocurrency donations and offered paid advertising placements in future GTA 6 videos. AI-generated and recycled footage was also being presented on social media as fresh leaks.
One of the fake GTA 6 sites appearing in Google search results alongside legitimate GTA 6 coverage
This isn’t the first time GTA 6 has been caught up in a major leak. In 2022, Rockstar confirmed that an attacker had stolen and published development footage of the game.
Leaks create exactly the kind of environment malware operators can exploit: huge demand for unofficial material, mixed with fakes, promotions, scams, and genuine leaks that can all be made to look remarkably similar.
The fake GTA 6 demo is another part of that ecosystem, but one designed to steal passwords and logged-in browser sessions.
What the file actually does
The installer belongs to the Vidar family, a well-established infostealer we’ve seen in other recent malware campaigns that is sold as a service to cybercriminals. Malwarebytes detects this sample, and blocks the websites and network infrastructure associated with the campaign.
Vidar is designed to steal the information browsers remember for you. That could give attackers access to accounts including your email, social media, gaming, and shopping accounts.
In this sample, it went looking for:
Saved passwords and login details
Session cookies
Browsing and download history
Autofill and other saved browser profile data
Credentials stored by FTP clients
Our analysis showed 19 browser targets, including Chrome, Edge, Firefox, Brave, Opera, and Vivaldi. It also searched Thunderbird profile directories and targeted Perplexity’s Comet browser and the WebView2 browser embedded inside Roblox Studio.
The behavior report showed no persistence mechanism designed to make the malware survive a reboot. We observed no startup entry, scheduled task, or installed service that would relaunch it automatically.
But an infostealer doesn’t need to remain on your computer to cause lasting damage. Once passwords or session tokens have been stolen, attackers can continue trying to use them after the malware itself is gone.
That is one reason an infection can be easy to miss. In our analysis, it produced no visible user-facing window and installed nothing that a user would normally notice. From the victim’s perspective, the supposed GTA 6 installer may simply appear to do nothing.
Why changing your password might not be enough
If you use a password manager and unique passwords, you might assume there is little useful information for a stealer to take directly from your browser.
Session cookies change that.
When you sign in to a website, the site gives your browser a session token that tells it you have already authenticated. That is why you do not have to enter your password every time you open another page.
If an attacker steals a usable session token, they may be able to reuse that authenticated session without going through the normal login process again.
That matters for 2FA too. 2FA protects the login process, but a stolen session was created after that login had already succeeded. Depending on the service and its security controls, an attacker may therefore be able to reuse the session without being asked for your password or 2FA again.
This is why changing your password after a stealer infection may not be enough by itself. A password change does not necessarily invalidate every existing session.
You should also use the service’s option to sign out everywhere, revoke active sessions, or remove unfamiliar devices.
How to protect yourself
Check it’s official. Do not assume an unofficial “demo,” beta, early build, or leaked version is legitimate just because a game has not launched yet. Check the publisher’s official website and store pages first.
Use official download sources. Download games and demos only from official sources such as Steam, the Epic Games Store, PlayStation Store, Xbox, or the publisher’s own website.
Check the file size. A one-megabyte executable cannot contain a modern AAA game.
Don’t trust search results. Attackers can buy advertisements and optimize malicious pages for exactly the terms people search during major news events.
Don’t trust appearances. Official artwork, logos, screenshots, and page layouts are easy to copy.
Be careful with leaked material. By definition, there is no official distribution channel to tell you which download is genuine. If what you want is GTA 6 footage, Rockstar’s official Extended Look arrives on August 27.
Block malicious sites. Malwarebytes Browser Guard blocks malicious pages like these before they load, helping stop the attack before a download ever reaches your computer.
What to do if you ran it
If you downloaded and ran a supposed GTA 6 demo installer, assume credentials and active browser sessions on that computer may have been compromised.
Work through the following steps:
Scan the affected computer with Malwarebytes or another trusted security product and remove anything it detects.
Use a clean device to change important passwords, starting with your primary email account, followed by banking, payment services, and accounts tied to your identity.
Sign out of active sessions everywhere you can. Look for options such as “sign out everywhere,” “log out of all devices,” or “active sessions.” This is what deals with stolen session cookies and tokens.
Check your accounts for changes you did not make, including new email forwarding rules, recovery addresses, phone numbers, authorised applications, and unfamiliar devices.
Enable two-factor authentication on accounts that don’t already have it.
Monitor important accounts closely for unusual activity over the following weeks.
Check gaming accounts as well. Steam, Epic, and similar accounts can contain saved payment methods, valuable inventories, and access to other services.
Technical details
It uses your own browser to unlock your data
Browsers increasingly use stronger encryption and application-level protections for saved passwords and cookies. In particular, Chromium-based browsers have made it harder for unrelated software to simply copy a database and decrypt everything directly.
This sample uses a different approach.
During our analysis, it launched the actual Chrome, Edge, and Firefox executables installed on the system. It started them in headless mode, disabled logging, and pointed each one at a temporary user-data directory.
In other words, it was not launching a fake browser. It was using legitimate browser binaries already trusted by the system.
The point is to work through a browser process that can access its own protected data rather than trying to defeat those protections from the outside.
Afterward, the malware issued commands to delete the temporary browser directories it had created.
The protection has not necessarily been broken. It has been approached through software that is already allowed to use it.
That is an important distinction, because browser-level encryption makes credential theft harder, but it cannot make running an unknown executable safe.
The delivery address can come from a social media profile
Vidar has a well-documented habit of using what researchers call dead-drop resolvers.
Instead of relying only on a command-and-control address permanently embedded in the malware, Vidar variants can retrieve the current destination from attacker-controlled profiles hosted on legitimate services such as Telegram and Steam.
This makes the infrastructure easier to rotate: operators can update a profile instead of rebuilding and redistributing the malware.
The activity we observed is consistent with that pattern.
The sample contained profile URLs for Telegram, Pinterest, and Steam Community, and network connections to all three services were observed during analysis.
It also communicated with attacker infrastructure. Most notably, it sent multipart POST requests to ses.1001gacor.org.
The sample also established a TLS connection to ket.sm188daftar.mom.
The important point is that traffic to a legitimate service such as Telegram, Pinterest, or Steam can blend in with ordinary network activity. Blocking one malicious server is also less useful when the malware has another place it can check for updated infrastructure.
A wave of websites is offering to check whether your antivirus is working. They call themselves SysScan, carry Microsoft branding, and all reach the same conclusion: Your computer has serious problems, and the cause is the antivirus software you installed.
Windows, they claim, no longer supports third-party antivirus. Uninstall it immediately.
That is false, and it is the first step in a refund scam designed to get victims onto the phone, remove their security software, and ultimately hand over personal, banking, and remote-access information.
We found eleven of these sites on a single host. Although the names vary, the sites work in essentially the same way: Run a convincing-looking but fake security scan, tell the victim their antivirus is causing problems, collect their information, and prepare them for a supposed refund call.
What to know if you see one of these scans
A website cannot run a real security scan. It can only read basic browser data like your operating system, screen size, and approximate location—not check for malware, memory issues, or missing security patches.
Microsoft still supports third-party antivirus software, and legitimate refunds never require you to uninstall security tools or install remote-access software.
If a site tells you to do any of that, close it immediately.
Technical analysis
The scan reads real data and draws invented conclusions
Part of what makes the scam convincing is that the page does measure some real things.
It reads information that a browser legitimately exposes—your user agent, screen dimensions, device memory, processor count, permission states, network information, available web features, and some page performance timings. That allows the results to appear specific to your machine.
But the security conclusions aren’t connected to those measurements.
Fifty of the findings are fixed text written into the page, grouped in blocks that the developer labelled as fake checks.
Among them are claims that your browser sandbox is compromised, kernel page-table isolation is inactive, your memory is vulnerable to Rowhammer, no Trusted Platform Module was found, WebRTC is leaking your local IP address, and your processor is thermally throttled.
A web page cannot determine those things.
One finding even reports how many days behind your security patches are, using a random number generated whenever that check runs. Run the scan again and you get a different answer.
Even checks that use genuine information are twisted into warnings. An encrypted connection becomes a downgrade risk. Cookies enabled is a warning; cookies disabled is a failure. Ordinary features found in modern browsers are flagged as ways to identify you.
Our fully updated test browser was reported as possibly outdated.
Most tellingly, the score is constrained in the code to between 13 and 30 out of 100. It cannot report anything above 30, regardless of the computer being tested.
Passing is not a possible outcome.
Why the scam tells you to uninstall your antivirus
Telling someone to remove their antivirus is the most consequential thing these pages do, and it serves the scammers in two ways.
First, it removes software that could interfere with what comes next, including remote-access software and anything installed during the session.
Second, it tells the scammers which security product the victim uses.
The site records which antivirus was removed from a list of 28 named products, plus an Other option. Enterprise security software also appears on the list, suggesting the scam is also prepared for people using work computers.
The claim is made more believable by distorting something that is true. Windows includes its own antivirus protection, Microsoft Defender Antivirus. When a compatible third-party antivirus product is installed, Defender can move into a passive state because the other product is providing protection.
That does not mean Windows no longer supports third-party antivirus.
The form appears built for the scammer, not the victim
After the scan, the site presents a customer information form.
It collects a name, address, phone numbers, email address, refund amount and reason, bank name, cryptocurrency username, antivirus product, and the ID and password for a remote-access session. Users can choose from 30 different remote-access tools.
It also requires an Agent ID, Agent Name, and Company.
Those fields strongly suggest the form is designed to be filled in by an operator during a call, potentially while they can see the victim’s screen. The code does not prove who types the information, but there is little reason for agent details to appear on a form intended solely for a customer.
One field even asks whether explicit content is involved. Embarrassment and shame can be powerful tools for scammers because victims may become less willing to discuss what happened with a partner, family member, or bank.
When the form is submitted, the browser bundles the customer, agent, remote-access, antivirus, and banking details into a single message and sends it directly to Telegram’s bot API.
There is no application backend involved, making the sites cheap to host and easy to abandon when they attract attention.
It also exposes another lie. The site states in several places that no data is sent and nothing is collected. Even before the form is submitted, it contacts external IP and geolocation services. Once the form is submitted, the information entered is sent to a Telegram group chat.
Then comes the supposed refund call
After submitting the form, the victim is sent to a page saying a refund manager will call within three to five minutes.
The page plays a looping video of a man in an office and prevents the victim from pausing it, switching it to full screen, or opening the right-click menu.
.kadence-column455177_36c2bb-be{max-width:700px;margin-left:auto;margin-right:auto;}.wp-block-kadence-column.kb-section-dir-horizontal:not(.kb-section-md-dir-vertical)>.kt-inside-inner-col>.kadence-column455177_36c2bb-be{-webkit-flex:0 1 700px;flex:0 1 700px;max-width:unset;margin-left:unset;margin-right:unset;}.kadence-column455177_36c2bb-be > .kt-inside-inner-col,.kadence-column455177_36c2bb-be > .kt-inside-inner-col:before{border-top-left-radius:0px;border-top-right-radius:0px;border-bottom-right-radius:0px;border-bottom-left-radius:0px;}.kadence-column455177_36c2bb-be > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column455177_36c2bb-be > .kt-inside-inner-col{flex-direction:column;}.kadence-column455177_36c2bb-be > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column455177_36c2bb-be > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column455177_36c2bb-be{position:relative;}@media all and (min-width: 1025px){.wp-block-kadence-column.kb-section-dir-horizontal>.kt-inside-inner-col>.kadence-column455177_36c2bb-be{-webkit-flex:0 1 700px;flex:0 1 700px;max-width:unset;margin-left:unset;margin-right:unset;}}@media all and (max-width: 1024px){.kadence-column455177_36c2bb-be > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.wp-block-kadence-column.kb-section-sm-dir-vertical:not(.kb-section-sm-dir-horizontal):not(.kb-section-sm-dir-specificity)>.kt-inside-inner-col>.kadence-column455177_36c2bb-be{max-width:700px;-webkit-flex:1;flex:1;margin-left:auto;margin-right:auto;}.kadence-column455177_36c2bb-be > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}
.kadence-column455177_e97529-df > .kt-inside-inner-col{padding-top:var(--global-kb-spacing-xs, 1rem);padding-right:var(--global-kb-spacing-xs, 1rem);padding-bottom:var(--global-kb-spacing-xs, 1rem);padding-left:var(--global-kb-spacing-xs, 1rem);}.kadence-column455177_e97529-df > .kt-inside-inner-col,.kadence-column455177_e97529-df > .kt-inside-inner-col:before{border-top-left-radius:0px;border-top-right-radius:0px;border-bottom-right-radius:0px;border-bottom-left-radius:0px;}.kadence-column455177_e97529-df > .kt-inside-inner-col{column-gap:var(--global-kb-gap-sm, 1rem);}.kadence-column455177_e97529-df > .kt-inside-inner-col{flex-direction:column;}.kadence-column455177_e97529-df > .kt-inside-inner-col > .aligncenter{width:100%;}.kadence-column455177_e97529-df > .kt-inside-inner-col{background-color:#f8f4f4;}.kadence-column455177_e97529-df > .kt-inside-inner-col:before{opacity:0.3;}.kadence-column455177_e97529-df{position:relative;}@media all and (max-width: 1024px){.kadence-column455177_e97529-df > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}@media all and (max-width: 767px){.kadence-column455177_e97529-df > .kt-inside-inner-col{flex-direction:column;justify-content:center;}}
TRANSCRIPT ========== Thank you for completing the form. Your request has been successfully received and is now being reviewed. A refund manager will be contacting you shortly to verify your information and assist with the next steps. Please remain available to answer your phone. We appreciate your patience. Please keep your phone nearby and be prepared to answer the call so we can process your request as quickly as possible. Thank you for choosing our services.
The apparent purpose is to keep the victim on the page while contact is arranged and reassure them that an official process is underway.
Whether the caller is a different scammer is not something the code can tell us, but the structure creates a clear handover point.
By the time anyone starts asking about bank details, the victim has already seen a Microsoft-branded security scan, been told their computer has serious problems, removed their antivirus, and entered information into what appears to be an official refund process.
The site shows signs of AI-generated code
The video on the waiting page is synthetic, and the clip is zoomed and cropped inside its frame.
The code points in a similar direction. It is heavily commented in the explanatory, self-narrating style often produced by AI coding tools, including notes explaining why the scan is deliberately paced and why spoken lines use a terse security-console tone.
Some comments describe the deception directly. Eight blocks of invented findings are labelled as fake, while around 20 checks that read genuine values are described as exaggerated.
One comment near the top of the file even states that no data leaves the device, a few hundred lines before the function that sends the form to Telegram.
Source code cannot prove how it was created. But the fraud-specific elements—including the US bank list, agent identifiers, and explicit-content field—appear to have been fitted into a broader scanner template.
How to spot a fake computer security scan
There are several warning signs that give scams like this away:
A website claims to find deep problems with your computer. A web page can see some information your browser provides, but it cannot inspect things such as your firmware settings, antivirus status, memory vulnerabilities, or exact Windows patch level.
Every result is bad. A diagnostic that cannot produce a passing result isn’t really diagnosing anything.
You’re told to uninstall your antivirus. Microsoft continues to support third-party security software on Windows.
You’re asked to install remote-access software. Legitimate refunds do not require someone to take control of your computer.
You’re asked for banking or cryptocurrency information. A legitimate company should not need remote access or cryptocurrency to process a refund.
The page relies on a familiar logo. A Microsoft or Apple logo on a website does not mean the company operates it. These sites can switch branding depending on the operating system they detect.
If this has already happened
If you’ve installed remote-access software or allowed someone to control your computer, disconnect the computer from the internet and remove the remote-access tool.
Reinstall the antivirus software you were told to remove, update it, and run a full scan.
If you gave the scammers banking information or allowed them to access your online banking, contact your bank immediately using a phone number you look up yourself. Tell them you may have been targeted by a refund scam.
Change your email and banking passwords from a different, trusted device.
If money was taken, report the scam to the Federal Trade Commission (FTC) at reportfraud.ftc.gov and the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov.
And don’t let embarrassment stop you from telling your bank or someone you trust what happened. Creating that embarrassment can be part of the scam because it makes victims less likely to ask for help. Acting quickly gives you the best chance of limiting any loss.
Scammers are creating fake crypto wallet-checking sites that promise to tell you whether a wallet is linked to suspicious activity. Instead, they try to trick you into giving them access to your crypto.
What real AML checking looks like
AML stands for anti-money laundering. These are rules that require banks and other regulated businesses to screen customers for ties to crime. It’s designed to prevent cybercriminals from hiding or moving illegally obtained money.
In the crypto world, this usually means checking whether a wallet address has links to hacks, scams, sanctioned entities, or other suspicious activity based on its transaction history.
For a basic wallet check, the service only needs the wallet’s public address. You don’t need to connect your wallet, approve anything, or sign a transaction. It’s just a lookup.
If an AML checker asks you to connect your wallet rather than simply enter its public address, treat that as a warning sign.
How the scam works
These sites look professional. Many pretend to be the legitimate service, AMLBot, or use names such as “AML Check,” copying the logo, layout, and language of legitimate wallet-screening services.
Fake AMLBot siteReal AMLBot site
You’re invited to choose your cryptocurrency, click Check Wallet, and connect your wallet to get your results.
Connecting a wallet by itself isn’t enough to steal your crypto. It reveals your public wallet address, which the scammers use to create a transaction specifically for your wallet. That transaction is then sent to your wallet for you to approve.
The site is designed to get the victim to approve a transaction generated by the scammers. You should never approve a transaction you don’t understand or weren’t expecting.
A fake AML Check site
Another fake AML Check site
A fake AMLBot site
Once the site knows your public address, it can also see the assets associated with it and tailor the scam accordingly.
One version we reviewed makes the process look like a genuine security check. A progress bar displays messages such as “Checking wallet history…” and “Verifying compliance…”
Partway through, the site shows a fake error claiming the wallet needs a small top-up to “cover the fee” before the check can finish. Clicking Retry plays the same progress animation again before producing a reassuring “Clean, Low Risk” result and offering a report to download, regardless of whether a genuine check took place.
The progress bars, error messages, and final result are all designed to make the process feel legitimate.
Why the scam works
People using an AML checker are already trying to protect themselves. The scam takes advantage of that caution by making each step look like part of a normal security check.
The fake progress bar suggests that something is being analyzed. The supposed fee makes the interruption seem plausible. And the “Clean, Low Risk” result makes it appear that the check worked.
We’ve also seen the same basic design and process appear under several different names and logos, suggesting the same scam template is being reused and rebranded.
What to do if you connected a wallet
What you need to do depends on what happened.
If you only connected your wallet: Disconnect the suspicious site from your wallet. Simply connecting shouldn’t give the site permission to move your crypto.
If you approved access to your tokens: Check your wallet for token permissions you don’t recognize and revoke them. Your wallet provider may have an approval checker that shows which apps or smart contracts have permission to access your tokens.
If you confirmed a transaction or signed something you didn’t understand: Check your recent wallet activity. If you think your assets may be at risk, move your remaining funds to a new wallet.
If you entered your recovery phrase or private key: Treat the wallet as compromised and move your assets to a new wallet with a new recovery phrase.
If you downloaded something from the site: Don’t open it. Delete it and run a malware scan.
If you’ve already lost money: Be wary of anyone who contacts you offering to recover it for a fee. Recovery scams commonly target people who have already had crypto stolen.
Crypto transactions generally can’t be reversed once they’re confirmed, so acting quickly matters if you’ve approved something suspicious.
How to spot a fake AML checker
Before using a wallet-checking service, check the website address carefully, especially if you reached it through an ad, social media post, message, or search result.
Be particularly cautious if an AML checker asks you to connect your wallet, approve unexpected access to your tokens, confirm a transaction, send crypto to complete a check, or share your recovery phrase or private key.
A basic wallet screening only needs the public wallet address. It shouldn’t require access to your crypto.
Pro tip: Malwarebytes Browser Guard can block known scam, phishing, and malicious websites before you interact with them.
Most wrong-number texts are harmless. Some are the first step in a carefully planned scam. By replying, you may be confirming that your number is active and that you’re willing to engage with strangers, making you a more valuable target for future fraud. Here’s why a polite response can be worth money to cybercriminals.
The politeness trap
Sunday night. You’re on the couch, half-watching Netflix, when your phone buzzes.
“Hey! Are we still on for dinner tomorrow? Don’t forget the wine ”
You don’t recognize the number. You glance at it for two seconds, then type what most polite people would:
“Sorry, I think you have the wrong number!”
You put your phone down. Go back to Netflix, and forget about it within five minutes.
On the other end, though, your reply has just told the sender something valuable. Not because of a technical exploit or an invisible cyber-attack, but because you just proved you’re the kind of person who responds to strangers politely.
According to cybercrime intelligence reports, responsive phone numbers are worth significantly more than inactive ones. With a single reply, you’ve entered a global criminal ecosystem run by transnational syndicates that, according to analysts, moves tens of billions of dollars.
What your reply told them
Let’s be clear: the “wrong number” text is not a phishing link. It’s not malware. In many cases, it’s not even the scam itself. It’s a personality test.
The scammers already have your number. They may have bought it in bulk from a data breach for a fraction of a cent per record. They already know the message was delivered because their SMS gateway received no delivery failure. Text messages remain one of the most effective ways to reach people, with exceptionally high open rates and most being read within minutes. That’s one reason scammers prefer SMS to email.
What they don’t know is whether you’re worth spending more time on. Your reply told them three useful things:
You’re responsive. You saw the message and felt compelled to reply. This immediately places you in their top 15–20% most active numbers category.
You’re polite. You didn’t ignore it and didn’t respond aggressively. You wanted to help a stranger. Scammers deliberately exploit that instinct to be polite and helpful.
You reply quickly. The time between their message and your reply can reveal how closely you monitor your phone, help estimate your timezone, and indicate how likely you are to respond to future messages.
The two paths your number takes
From this moment, your story splits. Both paths described below play out across millions of phones worldwide.
Scenario A: The slow burn
Within minutes of your reply, another message arrives in response to yours:
“Oh no, I’m so sorry! But honestly, you seem like a really kind person. It’s rare to find polite people these days. I’m Sarah, by the way.”
Some people stop the conversation there. Others reply out of curiosity or because they’re simply being friendly. A few messages later, you’re in a conversation.
In some large scam operations, those early exchanges may be handled by AI (Artificial Intelligence) using open-source language models such as Llama or Mistral. That allows scammers to hold thousands of conversations at once and focus their time on the people who seem most likely to keep talking.
While keeping you engaged, the AI assigns you a real-time vulnerability score based on your response time and message length. If your score crosses a certain threshold, a human operator takes over. They read the conversation, learn your name, your job, and your communication style, then continue as though nothing has changed.
Within two or three weeks, this person has become a friend. They text you good morning, ask about your day, and send photos stolen from real social media profiles.
Around week three, they casually mention an investment:
“I’ve been making really good money on an investment platform lately. Almost $4,000 last month. It’s crazy.”
If you show interest, they’ll send you a link to a fake trading platform with a convincing design. You might deposit $500 to test it. The next day, your dashboard shows a fake gain of $1,800, so you invest more. A week later, the platform disappears, along with your money, and the person who texted you every day.
According to the FBI’s Internet Crime Complaint Center (IC3), investment fraud generated more than $4.5 billion in reported losses in a single year. To be clear: while most wrong-number texts never reach this stage, victims who fall for so-called “pig butchering” scams (long-term romance/financial scams) suffer catastrophic average losses ranging between $70,000 and $75,000 per person.
Scenario B: The silent recycling
In this scenario, you replied “wrong number” and never heard from them again. You think you dodged the scam, but instead your number was simply moved to a different category: “Active, responsive, polite, but not susceptible to the wrong-number hook.”
That profile still has enormous commercial value. Your number is added to a cleaned database and sold or reused for a different campaign.
A week later you receive a text from another number:
“Hi! I saw your profile on LinkedIn. We have an opportunity that’s a perfect fit for your background.”
Or:
“Your package couldn’t be delivered, update your address by clicking here.”
Or a fake alert from your bank warning of “suspicious activity.”
You’ll probably never connect these messages to the wrong-number text you received the week before. They’re different topics and different senders. But they may all be part of the same criminal ecosystem. The first message was simply a way to sort potential targets. Everything that follows is the actual attack.
The most common hooks
If you’ve received one of these messages (or something very similar), you’re not alone. These are some of the most common opening lines used in wrong-number scams, tested on millions of people and optimized to maximize response rate:
The friend who doesn’t exist:
“Hey! See you tonight at 6? Don’t be late ”
“Are you still free tomorrow?”
“Did you send those files to the office?”
“Hey Marco, are we still on for dinner tonight?”
The concerned neighbor:
“Sorry to bother you, I’ve noticed your dog sometimes runs into my yard.”
“I found a phone number on the dog tag, is this yours?”
“Hi, your package was delivered to my address by mistake.”
The professional mix-up:
“Hi, I tried to reach you about the delivery but you didn’t answer.”
“The shipment arrived at your address, can you confirm?”
“This is Mike from the office, did you get my earlier message?”
The family emergency:
“Do you know Sarah? There’s been an emergency.”
“Is this [common name]’s number? Something happened.”
The recruiter:
“Hi! I came across your profile, we have an incredible opportunity.”
“Hey, I’m reaching out about a position that matches your background perfectly.”
If you’ve received one of these messages, it doesn’t automatically mean it’s a scam. People genuinely do text the wrong number sometimes. But if the conversation quickly moves to making small talk, asking personal questions, or encouraging you to keep chatting, stop replying.
These messages aren’t usually sent by a lone cybercriminal. They’re part of a highly organized criminal industry with its own market dynamics and global supply chains.
In January 2026, Cambodian and Chinese authorities arrested Chen Zhi, president of Prince Holding Group, accusing him of running a network of scam compounds across Southeast Asia where thousands of trafficked people were forced to manage these conversations. Those operations relied on underground marketplaces where criminals could buy everything they needed, from phone lists and stolen identities to AI tools and fake investment websites.
The scale is staggering. Blockchain analytics firm Elliptic estimates the Huione Guarantee underground marketplace processed more than $134 billion in transactions. Separately, researchers at the University of Texas at Austin estimate that pig-butchering scams stole more than $75 billion in cryptocurrency over four years.
The scam funnel: Costs and revenue
To understand why this ecosystem is so huge, look at the math. Sending hundreds of thousands of text messages costs very little. Even if only a tiny fraction of people reply, and an even smaller number eventually send money, the profits can far outweigh the costs.
Look at this illustrative model of a campaign sending 100,000 SMS messages:
The figures in this model aren’t arbitrary. They combine observed pricing from underground marketplaces such as Russian Market and BidenCash with average victim losses reported by law enforcement agencies, including the FBI’s Internet Crime Complaint Center (IC3).
Even allowing for variation between campaigns, the economics are compelling. A single campaign can cost less than $1,000 to run while generating more than $200,000 in revenue, representing a potential return on investment (ROI) of 90x to 200x.
Those same economics are reflected in underground marketplaces, where verified, enriched contact details command significantly higher prices than raw data. In our previous investigation into underground marketplaces, we found that a typical stolen personal record sold for around 95 cents. The more criminals learn about a potential victim, the more valuable that person’s data becomes.
That’s a 4,000% value increase generated by a single polite reply.
From there, scammers can enrich that record with publicly available information such as your name, employer, social media profiles, and estimated demographics using automated open-source intelligence (OSINT) techniques.
The more complete the profile becomes, the more valuable it is. Researchers monitoring underground marketplaces have found that enriched, pre-profiled contacts command premium prices because they’re more likely to become victims of high-value pig-butchering scams that generate billions of dollars in illicit revenue each year.
How do they know who you are?
Before that text reaches your phone, your number may already have passed through automated script pipelines capable of cross-referencing tens of thousands of records in minutes.
Acquisition: Your number is pulled from historical data breaches, such as the Facebook leak affecting 533 million users, Twitter/X data leaks, or massive aggregated databases like Naz.api, and the Mother of All Breaches (MOAB), a collection of more than 26 billion records compiled from thousands of previous breaches.
Automated scraping: Software queries public sources to check whether your number is linked to an active WhatsApp account, collect your profile information and picture and match the number to public LinkedIn, Instagram, and Facebook profiles.
Data broker integration: Scammers exploit the same commercial data services used by marketing companies to associate a phone number with estimated age, address, and income bracket.
The result is a psychographic and commercial profile that helps scammers choose the most convincing approach. If your social media shows you have a dog, you might receive the neighbor hook: “Your dog keeps getting into my yard.” If you recently changed jobs on LinkedIn, the fake headhunter hook activates.
The human factor: Modern slavery
There’s one aspect of these scams that’s often overlooked: many of the people sending the messages are victims themselves.
In its August 9, 2023 policy report, the United Nations Office on Drugs and Crime (UNODC) described a human rights crisis tied to forced criminality in Southeast Asia. It estimates at least 120,000 people in Myanmar and tens of thousands in Cambodia are being held in fortified mega-compounds run by criminal syndicates.
Many were lured by fake job adverts promising legitimate work in digital marketing or customer service. Once they cross the border, their passports are confiscated. They were stripped of freedom and forced, under the threat of violence, to spend up to 16 hours a day managing dozens of scam conversations. Those who failed to meet financial targets were often beaten, isolated, or sold to other compounds.
When you reply to one of these messages, you’re interacting with a system designed to simultaneously exploit your financial availability and the enslavement of another human being.
Breaking the chain
You can’t erase your number from dark web databases: that damage may have done years ago. But you can make your profile far less valuable to scammers.
Make yourself harder to profile: Review the privacy settings on any messaging apps and social media platforms that use your phone number. Limit who can see information such as your profile photo, status, last seen, and phone number. The less information scammers can gather automatically, the harder it is to build a detailed profile about you. On WhatsApp, for example, you can set Profile Photo, About, Status, and Last Seen to My Contacts. On Telegram, set Phone Number to Nobody.
Report before you block: Blocking protects only you. Reporting protects everyone. When you use WhatsApp’s Report and Block function, the last five messages in the chat are sent to Meta’s security teams. If enough people report the same number, it may be permanently banned, destroying the entire active campaign on that line.
The golden rule: If you receive an unexpected message from an unknown number, the safest response is no response at all. Don’t reply, don’t explain yourself, and don’t worry about seeming impolite. If it’s a genuine wrong number, the sender will usually realise their mistake and move on. If it’s a scam, you’ve denied the criminals exactly what they wanted: proof that your number is active and that you’re willing to engage.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
TikTok-branded “rewards” pages are promising users cash for checking in every day, completing small tasks, and earning points. Those points supposedly convert into real money, and the balances look enormous. A countdown timer usually warns that your balance is about to expire. But when you try to withdraw it, there’s always something else you need to do first.
If you just want the short version
TikTok does have a legitimate Creator Rewards Program, but it doesn’t work like the sites we’re talking about here. Creator Rewards is for eligible creators in certain countries who meet specific requirements. They earn rewards for eligible original videos, not for checking in every day or completing tasks on a separate rewards website.
If you find a TikTok-branded site offering large cash rewards for check-ins, referrals, or simple tasks, don’t assume it’s legitimate just because TikTok has its own rewards program.
You can end up chasing a payout that was never coming, handing over personal or banking details, or installing an unwanted app.
Fake TikTok rewards sites
Fake TikTok rewards sites
Fake TikTok rewards sites
Fake TikTok rewards sites
Fake TikTok rewards sites
How these pages typically work
Most versions of this scam are built to look like a mobile shopping or loyalty app. There’s a TikTok logo, a “welcome back” greeting, a daily check-in tracker, and tabs for tasks, referrals, and your profile. At first glance, it can easily look like an official rewards program connected to TikTok.
When you tap through to the “redeem” screen, the numbers can show a cash balance in the thousands, converted from a huge pile of points, along with a countdown warning that your balance is about to expire. The minimum withdrawal is usually low enough to make cashing out look easy.
It isn’t.
Sites like this tend to introduce one more requirement every time you get close to actually withdrawing the cash. Refer more friends, watch more videos, complete a sponsored offer through an affiliate network, or download a separate app to “verify” your identity.
The app download may be the real goal, particularly if the operator gets paid for generating installs. The app could also be adware or other unwanted software.
Big numbers don’t mean real money
Nothing on these pages reflects a real ledger. A balance on the screen doesn’t mean there’s money waiting for you.
On a fake rewards site, the points, cash balance, and countdown can simply be numbers generated by the site itself, with no connection to TikTok’s actual systems.
The operator simply invents a sum that feels too good to walk away from.
So who is making money?
These sites tend to make money the same way most ad-funnel scams do: through affiliate and CPA (cost-per-action) programs.
CPA means the site operator can get paid when you do something, such as clicking an ad, signing up for a service, or installing an app. So even if you never receive the promised reward, your clicks, sign-ups, and downloads can still make money for someone else.
Why it’s easy to get pulled in
A daily check-in streak creates a small sense of investment. Walking away means giving up your streak and the money you think you’ve already earned.
Then there’s the big balance sitting on the screen and a countdown telling you it’ll disappear if you don’t act soon. Together, they give you plenty of reasons to keep going and very little time to question whether any of it is real.
What to do if you find one
Don’t enter banking details, card numbers, or ID information unless you’ve confirmed you’re using an official TikTok service.
If you were prompted to download an app outside TikTok itself, don’t install it. If you already have, uninstall it and run a security scan on your device.
Don’t refer friends or family to keep a streak going or unlock a withdrawal. You’d just be pulling them into the same funnel.
Check rewards in TikTok itself. TikTok’s Creator Rewards Program is for eligible creators and is managed through TikTok. If a separate website claims you can earn TikTok cash rewards through check-ins or simple tasks, don’t assume it’s part of the same program.
Reward-mill scams like this aren’t unique to TikTok. The same check-in-and-cash-out formula appears with other brand names too. The name may change, but the trick is much the same: Keep you clicking with the promise that your money is just one more task away.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Meta announced it’s rolling out a new feature for WhatsApp users in the fight against scammers.
Scam Alert is an optional beta feature that uses an on-device machine-learning model to flag likely scam messages from people who are not in a user’s contacts.
The Scam Alert feature arrives as scammers increasingly use WhatsApp for impersonation, fake jobs, fake sales, investment fraud, romance baiting, malicious links, and payment requests. These campaigns often begin on another platform before moving victims into a private chat, where criminals can apply pressure and build trust.
Once enabled, Scam Alert downloads a machine-learning model to the device and examines incoming messages from non-contacts for patterns associated with scams. WhatsApp says the model uses linguistic signals and conversational structure learned from scam conversations previously reported by users.
It is a meaningful new defensive layer, but it will not block anything. Instead, it alerts the user to stop and think carefully before engaging with the sender.
There’s another important limitation: some of the most effective WhatsApp scams arrive from a compromised contact, such as the recent “vote for my friend” account-takeover campaign. Because the message appears to come from someone the victim already knows, an unknown-sender warning may never appear.
Scam Alert is another step in Meta’s anti-scam campaign across WhatsApp, Facebook, and Messenger to fight sophisticated fraud tactics.
If the model identifies what might be a scam, WhatsApp displays a warning banner in the chat. The sender does not see the warning, so the feature should not tip off a scammer that their approach has been detected.
Users can then:
Block the sender, preventing further messages.
Report the chat to WhatsApp.
Continue the conversation if they believe it is legitimate.
Mark the chat as trusted, which removes the warning and prevents Scam Alert from flagging that conversation again.
WhatsApp’s Scam Alert is a promising example of using on-device AI to add friction to scams without requiring a provider to read private conversations. Its optional nature, local classification, transparency commitments, and lack of automatic reporting are notable design choices for an encrypted messaging service.
The feature is currently in a limited beta rollout and is being tested with researchers in Meta’s bug bounty community before a wider release.
Don’t click unexpected links, particularly if the message asks you to verify, connect, or link your WhatsApp account.
Never follow instructions to link devices or scan QR codes unless you initiated the action yourself.
Regularly review your linked devices in WhatsApp (Settings > Linked devices) and log out of any you don’t recognize.
To stay out of the hands of scammers:
Be wary when a Facebook or Instagram exchange tries to migrate to WhatsApp. That handoff to a private channel is a classic scammer move, taking the conversation away from public scrutiny and platform enforcement.
Research the account that contacted you. What other activity is there on the account? Do they have an established profile?
Pay with a card or service that offers chargeback protection. Never pay by bank transfer, cryptocurrency, gift card, or Friends and Family payment methods when buying from someone you don’t know.
Remember that seeing an ad on a major platform isn’t an endorsement. Scammers routinely place ads alongside legitimate businesses.
If you’re unsure whether a flagged chat is a scam attempt, you can always ask Malwarebytes Scam Guard for a second opinion. It’s free, available for mobile, desktop, and integrated into major AI chatbots like ChatGPT and Claude.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
A video game about drone warfare may look like an unusual cybersecurity story. But cybersecurity isn’t only about malware or stolen passwords. Sometimes it’s about understanding how online platforms are used to influence decisions, build trust, and persuade people to share personal information or take actions they otherwise wouldn’t.
According to Straight Arrow News, the online game Drone Battle: Ukraine is linked to Russia’s Alabuga Special Economic Zone in Tatarstan, a site associated with the production of attack drones used in the war against Ukraine. Investigators say the game is the latest part of a broader campaign that has used major social media platforms, including YouTube, TikTok, Instagram, and X to reach young people.
The game is just the lure. Investigators say it forms the entry point to a recruitment funnel that markets education, careers, travel, community, and technological opportunity to young people before ultimately steering some recruits toward jobs assembling drones at Alabuga.
Available in English, Russian, and Chinese, Drone Battle: Ukraine presents a stylized conflict between Russia and NATO. But investigators say the game is only one part of a larger campaign that combines games, esports tournaments, influencers, and career messaging to recruit young people globally into Russia’s drone industry.
This campaign is not limited to drone combat. The same channels have also promoted games that frame construction work, teamwork, strategy, and professional development as challenges to be completed and levels to be unlocked.
That’s gamification serving a recruitment purpose. The game doesn’t have to persuade someone to take a job on its own. It only needs to make participation feel like a game, make a military-industrial workplace appear modern and exciting, and make the transition between the two seem natural.
Gamification itself isn’t unusual. Companies use games, quizzes, competitions, and rewards in education, training, and recruitment every day. The concern here is how those familiar techniques are combined with social engineering to influence decisions while obscuring the true nature of what’s being offered.
Social engineering
Social engineering is often described as a way of tricking people into giving up a password or opening a malicious attachment. But at its core, social engineering is the manipulation of human decisions. This campaign appears to use several familiar techniques at once.
Targeting: Investigators say Drone Battle: Ukraine is described in a registered patent as an “assessment tool in game form.” Rather than simply entertaining players, the game appears designed to engage people who may be receptive to later recruitment.
Baiting: The campaign advertises scholarships, training, free travel, housing, and career opportunities while, according to investigators, downplaying or concealing the true nature of the work.
Influencers: Social media promotions and seemingly personal testimonials make the campaign more persuasive than a straight-up advertisement.
Normalization: A drone in a game is a tool to use for victory and fun. Researchers have warned that game-like recruitment can make militarized narratives feel routine, technical, and emotionally distant.
Small steps: It starts with playing a game or following an account. People may then join a tournament, communicate with a recruiter, submit personal details, travel, and only later discover the full nature of the work. As with many social engineering campaigns, each interaction asks for a little more commitment, making the next step feel less significant than it really is.
Social platforms are taking action
US-based social media platforms have increasingly taken action against Alabuga-linked accounts after investigations alleged deceptive recruitment practices and human rights abuses associated with the campaign.
Social media platforms have been trying to disrupt the campaign for nearly two years. Following an Associated Press investigation in 2024, Google, Meta, and TikTok removed accounts linked to Alabuga Start for violating their policies. But according to the Foundation for Defense of Democracies (FDD), the organizers later created new accounts and continued recruiting across multiple platforms.
More recently, Ukraine’s Minister of Foreign Affairs, Andrii Sybiha, said that roughly 600 videos promoting Alabuga were removed from YouTube. The videos had been posted across hundreds of channels with a combined audience of more than 500 million subscribers. He wrote:
“The work does not end with removals. We will be now pursuing sanctions against individual bloggers who accepted payment to promote a sanctioned weapons manufacturer to millions of viewers.”
According to the Straight Arrow News investigation, however, the campaign remains active on X and Telegram.
How to stay safe
For home users, the traditional scam advice still applies: Independently verify a prospective employer, search for complaints and reporting, discuss an offer with someone you trust, and never pay to get a job.
Gamers should treat unsolicited career, travel, competition, and “exclusive training” offers with the same caution they would apply to any job pitch that feels unusually generous or vague. Offers to turn your gaming into a paid job should also be treated as “too good to be true.”
Other actions that might go a long way
Friends, families, educators, and youth organizations should talk openly about recruitment tactics without assuming that people targeted by them are naïve. They are often drawn in through a series of small steps that feel natural.
Platforms should investigate networks, influencer relationships, referral links, and coordinated messaging, not just individual posts or game titles.
Game developers and community platforms need reporting systems that are easy to find and will cater to recruitment concerns, not just cheating or abusive chat.
Governments and civil society groups in targeted countries need practical awareness campaigns that explain the specific promises being used and offer credible alternatives for education and employment.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
TikTok Shop is a real, functioning e-commerce feature built into the TikTok app, allowing users to buy goods without ever leaving TikTok. As it’s grown in popularity, scammers have begun cloning its appearance.Storefronts that reproduce its look, its trust badges, and its category layout closely enough to pass a quick glance are showing up as entirely separate, unverified websites.
The short version
If a shopping site looks like TikTok Shop but you didn’t reach it from inside the actual TikTok app, treat it as an unknown third-party store, not an extension of TikTok. It might look like TikTok, but it’s the same risks as any sketchy online shop: paying for something that never arrives, or handing over card details to a site with no accountability behind it.
Fake TikTok Shops
Clone sites in this category tend to reproduce TikTok Shop’s homepage design closely enough that, at a glance, they could pass for the real thing.
They have matching color schemes, matching layout, and language borrowed directly from the platform, such as “curated products,” “trusted sellers,” and “secure service.”
Underneath, they typically show the same kind of reassurance badges the real platform uses: claims of platform-verified sellers, local delivery guarantees, and after-sales support windows.
None of that trust signaling is backed by anything. It’s copied language and copied visual design sitting on top of a site with no verified relationship to TikTok at all. Scammers borrow the legitimacy that TikTok Shop has built up, then use it to move products—or simply take payment—through a storefront TikTok has no oversight of.
Wholesale stores and fake loan offers
A related version of this scam leans into bulk or wholesale pricing, offering goods across categories like fashion, home, and beauty, again wrapped in TikTok’s name and logo. Some of these sites go a step further and add a consumer credit or “loan service” option directly into the site navigation, sitting alongside ordinary shopping categories.
A legitimate wholesale marketplace doesn’t typically need to offer consumer credit as a checkout feature. When it does, it’s worth treating as a separate red flag from the shopping itself. Loan applications typically ask for far more sensitive information than a purchase does, including identity documents, banking details, and other personal data. Handing that information to a site that’s already impersonating a major platform significantly increases the risk of fraud or identity theft.
The checkout is the real risk
Both scams point to the same underlying concern: it’s not really about whether the products are real. It’s about what happens when you enter payment information into a storefront with a fake identity and no accountability. The order may never arrive, leaving you out of pocket, and your payment details themselves could be stolen, reused, or resold.
How to stay safe
Only use TikTok Shop from inside the official TikTok app, not a link from an ad, DM, or search result.
Always check a website’s address before entering any payment information. A convincing homepage doesn’t mean a legitimate business sits behind it.
Be skeptical of any shopping site that also pushes a loan, credit line, or financing offer at checkout.
Pay with a credit card rather than a bank transfer where possible. It gives you a dispute path if the order never shows up.
Brand impersonation is one of the oldest tricks in e-commerce fraud. TikTok Shop’s badge system and trust language are simply the latest assets being borrowed.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
A website built to look almost exactly like CNN’s homepage is telling visitors to download “the new CNN app.” But it’s not CNN’s app, and has nothing to do with the news company.
The campaign doesn’t stop at CNN. It also uses fake Stremio and Avast installers hosted on similarly convincing lookalike sites, all targeting Windows users. The installers are part of the same campaign to trick people into installing legitimate remote-management software that’s already linked to the attacker’s account.
Instead of downloading the software they expected, victims install O&O Syspectr, a genuine, digitally signed remote administration tool used by IT teams to manage computers. In the wrong hands, that tool can give an attacker remote access to a victim’s PC, allowing them to run commands, install additional software, or explore files and data. The CNN, Avast, and Stremio lures all point back to the same Syspectr account.
Another lookalike site uses a fake crypto-mining browser game instead of a trusted brand, but delivers the same software from a different Syspectr account.
Here’s what we found, why your antivirus has no reason to stop it, and the one 10-second check that would have caught it every time.
What the fake CNN page looks like
The site copies CNN’s real homepage closely enough that most people wouldn’t look twice. It has current headlines, the same layout, and even a red “Live Updates” tag on a real story. A pop-up interrupts almost immediately: “Get the latest news first in the new CNN app—it’s live and free,” with a red Download button underneath.
The file behind that button is named CNN_App.setupad4693fd-d903-4791-8f58-975261c93ca2.exe—the same Syspectr installer that shows up under different branding elsewhere, down to the account ID embedded in the filename.
The same trick, impersonating other brands
A lookalike site at avast-premium[.]shop mimics Avast’s real download page closely, including the logo, review scores, and a blue “Free download” button for “Avast One.” The file behind it is named AVAST_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe.
Another malicious site, stremiotv[.]online, copies Stremio, a legitimate media-center app. The file it pushes visitors to download is named Stremio_App.setup4693fd-d903-4791-8f58-975261c93ca2.exe.
Both carry the same account ID found in the CNN installer.
By impersonating trusted brands, the attackers trick visitors into installing the legitimate O&O Syspectr remote-access tool, which gives the attackers remote access to the victims’ computers.
A different kind of bait
Not every lure needs a trusted brand, however.
syncminer[.]xyz invents its own hook instead: an “idle miner” browser game showing a slowly-ticking cryptocurrency balance, with a “Download Miner Plugin” button promising faster payouts. The identical site also runs at idleminer[.]pro with the same layout, same game, and same download.
Both distribute the same file, named oo-syspectr-setup9158bf2a-ff25-4290-b96c-2dc5eb310391.exe outright, carrying its own account ID that is different from the CNN, Avast, and Stremio lures we saw.
It’s not malware, which is why antivirus can miss it
Every one of these files is a real, digitally signed piece of software from O&O Software GmbH, a legitimate German company. Syspectr is sold openly to IT departments and gives an operator remote desktop control and an admin-level command line on whatever machine it’s installed on.
That’s why antivirus software may not stop it. Antivirus is designed to detect malicious software, not flag a legitimately signed business tool just because of how it arrived on a computer. The attacker only has to convince victims to install a legitimate remote-management tool that’s already linked to the attacker’s account.
The 10-second check that gives it away
On Windows, right-click any installer like this, choose Properties, and open the Details tab. Two fields—File description and Product name—identify every installer we examined as O&O Syspectr, alongside a copyright notice for O&O Software GmbH.
The filename can be changed by anyone distributing the file, but those embedded details come from the signed software itself. Changing them would invalidate the digital signature, so they reveal what the installer really is.
How we know these are connected
Every Syspectr installer includes the account ID of whoever generated it, embedded directly in the filename. The CNN-, Avast-, and Stremio-branded files all carry the exact same account ID, showing they were created from a single Syspectr account and simply reskinned for different lures.
The Syspectr installer distributed through the fake crypto-mining game carries a different account ID, suggesting either a second operator using the same playbook or the same group operating under another account.
What this tool can actually do
Syspectr is designed to let IT administrators manage computers remotely. Depending on the subscription level, that can include viewing system information, monitoring running processes and services, managing Microsoft Defender, and restricting USB devices.
The paid plans add the features that matter most to attackers. They allow an operator to remotely control the victim’s computer, browse files, run commands, install additional software, and make changes to the system as though they were sitting in front of it. Higher tiers add tools for managing large numbers of devices and, on compatible hardware, even allow remote access when Windows won’t boot.
These remote-control features aren’t available on free Syspectr accounts. They require a Premium subscription or higher.
O&O Software response
O&O responded quickly. Within days, the company disabled Remote Desktop and Remote Console access for free Syspectr accounts, restricting both to paid plans only.
O&O has since identified and suspended the abusive accounts, also blocking them from adding new devices. O&O’s analysis found the attackers relied exclusively on Remote Console, not Remote Desktop. The company says it will keep scanning for this pattern and tighten restrictions further if needed.
It’s a solid response and O&O clearly has a handle on how the abuse is happening. Not every vendor moves this quickly or this effectively when their software gets abused.
How to protect yourself
Only download software from the vendor’s actual website. Search results and ads can lead to convincing fakes.
Before running any installer you’re unsure about, on Windows you can right-click it, open Properties > Details, and check the File description and Product name fields.
If you find O&O Syspectr installed and didn’t set it up yourself, uninstall it through Settings > Apps and run a full antivirus scan.
If you ran an installer like this recently, change passwords for anything you accessed on that machine afterward from a clean machine.
Protect yourself while browsing online. Malwarebytes Browser Guard blocks known scam and lookalike pages before you land on them.
Remember
Fake download sites don’t always deliver malware. Sometimes they deliver legitimate software that’s been weaponized by the person distributing it. That’s why it’s important to download software from the real vendor and, if something doesn’t feel right, check what the installer actually is before you run it.
In 2026, online scams have unfortunately become part of the new normal. They can appear almost anywhere, from social media and messaging apps to search results, websites, and online communities, and they can target anyone. Sometimes, all it takes is a moment of curiosity and a convincing offer.
Among the most devastating scams are so-called “get-rich-quick” schemes. These scams promise something that’s difficult for people to resist: the chance to make a lot of money, quickly and with little or no effort. It may come in the form of an investment opportunity, a new cryptocurrency project, or an exclusive chance to get in early before everyone else.
However, behind the promises of easy money can be carefully designed operations built to gain trust, collect deposits, and ultimately leave victims with significant financial losses. In some cases, scammers go to considerable lengths to make their projects appear legitimate, creating professional-looking websites, social media profiles, and convincing stories designed to attract as many victims as possible.
This is the story of one such project: a crypto scam discovered on a cybercrime forum, where the people behind it appeared to openly discuss and promote their operation.
What we found provides a glimpse into how modern online scams are built, promoted, and potentially used to target everyday consumers.
Meet “xrep”
Threat actor’s profile on a cybercrime underground forum
The threat actor known as xrep has been active in the cybercrime underground since March 2026. It appears that xrep has already built a positive reputation among customers, receiving favorable feedback for the services and solutions they provide.
Positive feedback left by another cybercriminal
In general, xrep specializes in ready-to-use solutions related to X, formerly known as Twitter. Rather than requiring customers to build their own infrastructure or develop the necessary tools, xrep offers what can essentially be described as a full turnkey solution for scammers.
Overview of services offered by xrep
This approach significantly lowers the barrier to entry for scammers looking to conduct malicious activities. By providing a ready-made package that requires little technical expertise to deploy, xrep enables individuals with limited skills to potentially launch scams with considerably less effort.
$TSLA scam: A crypto investment opportunity designed to steal
Tesla scam kit offer
The scam project, discovered on May 16 by the Malwarebytes research team on a high-profile cybercrime forum, is a good example of how modern scams combine social engineering, phishing, and financial fraud into a single operation.
The product, priced at just $500, is essentially a ready-made website designed to look like a legitimate cryptocurrency presale. The supposed opportunity is presented as an exclusive $TSLA token presale for users of X, creating the impression that visitors have been personally selected for an early investment opportunity.
Tesla scam kit description and pricing
The website is designed to look professional and trustworthy, clearly impersonating the Tesla brand name and company logo. It supports multiple languages and is optimized for both computers and mobile devices. But the most important part is what happens behind the scenes.
The scam begins with a fake “eligibility check.” Visitors are asked to enter their X username. The screenshots below are taken from the $TSLA token scam site.
The website then retrieves their real profile picture and uses it to generate a fictional token allocation. This makes the offer appear personalized, giving the victim the impression that they have been specifically chosen to participate.
Figure 7: Scam project screenshot
The site also uses classic psychological pressure tactics. A fake fundraising progress bar continuously increases, a countdown timer creates a sense of urgency, and warnings suggest that the token price will increase soon. These features are designed to create FOMO (fear of missing out) and encourage victims to act before they have time to question whether the investment is legitimate.
Once a victim is convinced, the scam offers two ways to lose money or access to their cryptocurrency wallet.
The first is a classic phishing attack. Victims are encouraged to connect their cryptocurrency wallet to receive a supposed 15% bonus. Instead of connecting a legitimate wallet, they are prompted to enter their 12-word recovery phrase, also known as a seed phrase.
This phrase is effectively the master key to a cryptocurrency wallet. Anyone who obtains it may be able to access the funds stored in that wallet.
The second method involves direct payments. After going through the fake wallet process, victims are redirected to a convincing-looking personal dashboard. There, they can see a fabricated token balance and are encouraged to purchase additional $TSLA tokens.
The victim is instructed to manually send cryptocurrency, such as Bitcoin, Ethereum, USDT, or Dogecoin, to an address controlled by the scammer.
Victims may believe they have made a legitimate investment, but no real tokens are being purchased. Instead, the scammer simply receives the cryptocurrency while the victim sees a fake balance displayed on the website.
What makes this operation particularly concerning is the level of control provided to the scammer. The kit includes an administrative panel where the operator can monitor victims, view their X usernames and locations, track their activity, and collect the recovery phrases entered into the phishing page.
The scammer can also check whether a stolen wallet contains valuable cryptocurrency. This allows them to identify which victims may be worth targeting further. The operator can even manipulate the fake balance shown to a victim, for example, increasing the displayed amount to make the victim believe their investment is growing and encourage them to send even more money.
The administrative panel also allows scammers to manage fake purchase orders and send personalized messages to victims. For example, if someone has already made a payment, the scammer can send a notification claiming that the transaction is delayed and that the victim needs to pay an additional network fee. This creates another opportunity to extract money from someone who has already fallen for the initial scam.
In other words, this is not simply a fake cryptocurrency website. It is a complete scam-in-a-box. The technical infrastructure, phishing functionality, fake investment dashboard, victim tracking, and administrative controls are bundled together into a ready-to-use package.
The significance of this discovery goes beyond this particular $TSLA-themed project. By selling a complete, turnkey operation, xrep effectively lowers the technical barrier for individuals who want to conduct cryptocurrency scams. Someone who may not have the skills to build a phishing website, develop an administration system, or create convincing investment interfaces can potentially purchase the kit and begin targeting victims with minimal effort.
For ordinary internet users, the lesson is simple: a professional-looking website does not make an investment opportunity legitimate. Personalized offers, countdown timers, rapidly increasing “fundraising” figures, and promises of exclusive access are all tactics that can be used to create a false sense of urgency. Most importantly, no legitimate investment opportunity should ever require you to give away your cryptocurrency wallet’s recovery phrase.
Once that phrase is compromised, the consequences can be devastating, and unlike a traditional bank transfer, cryptocurrency transactions are often impossible to reverse.
From reporting threats to removing them.
Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
Lina K., a co-worker, recently shared a firsthand account of how bots are adding League of Legends players via the Riot client friends list immediately after a match ends, striking up a flirty conversation, and eventually pushing an OnlyFans link. The pattern lines up with a wave of complaints that have piled up on Reddit and Facebook gaming communities over the past several months, and it fits into a broader trend of AI-assisted social engineering that has moved from dating apps straight into game clients.
The pattern
The scheme reported by multiple League of Legends players follows a near-identical script. A friend request lands in the Riot client within moments of a match ending, from an account whose name does not match anyone from that game. The message opens with generic flattery like “you played really well last game” or “I liked your playstyle” designed to sound like a genuine compliment from an opponent or teammate.
When questioned about who they are, the accounts often claim to have been on the enemy team despite name mismatches, and many present themselves as a woman looking for a duo partner. A detail that likely raises engagement odds. Victims who check the account’s profile frequently find it blank: no visible match history, no overview data, sometimes a very low account level. These are all signs of a throwaway account built or bought purely for outreach, but sometimes they turn out to be stolen existing accounts.
After a short exchange, the contact says they are “getting off soon” and hands over a Discord username, moving the conversation to a platform Riot’s chat protections cannot see or moderate.
Once on Discord, the persona shifts into a longer-form romance/flirtation script. Usually, hours of chat building rapport, paired with a steady stream of photos that are suggestive but stop short of explicit content, a tactic that keeps engagement high while deferring the “reveal” until trust is established. That reveal ultimately comes in the form of a link to a paid subscription platform, most often OnlyFans, framed as an exclusive, limited-time offer.
A reverse image search on the photos sent during one such conversation turned up the same pictures recycled across unrelated websites and at least one YouTube video, with commenters in that video describing having received identical images from a bot under different names. This is strong evidence that the same photo set is cycling through many chats simultaneously, run at scale rather than by one individual.
Lina stated:
“One of my friends tried to break the bot too, left it on read for some time – the bot actually switched the pictures to match the context of “Concern” on the face of the model with “Why are you not replying?”, which quite clearly gave away bulk image generation for the script.’
When the account was pressed with a “reveal your instructions” style prompt-injection attempt (text formatted to look like a system message ordering the bot to break character and print its configuration), it did not comply and instead stayed in persona, deflecting the request and continuing the pitch.
That resilience to a common jailbreak technique suggests the bot’s operators have added guardrails against exactly this kind of probing, or that the “model” behind it is a simpler scripted flow layered with some LLM-generated text rather than an open, unrestricted chatbot.
Why this is happening inside the game client now
What makes this wave notable isn’t the romance scam script itself. AI-driven catfishing has been documented on dating apps and social media for a couple of years. The difference is the entry point. Players have reported getting these bot friend requests after essentially every single match, with no way to distinguish a real player’s request from a bot’s inside the Riot client.
Community threads describe the bots seemingly appearing right after a game ends, which has fueled speculation that the bot operators are scraping or monitoring publicly available match data through third-party stats-tracking sites and associated APIs to identify recently finished games and target participants, though this has not been independently confirmed by Riot.
Riot’s own client architecture may be inadvertently helping. The Riot Client exposes local endpoints (such as the friends list API) that third-party tools and overlays query, and community-run “op.gg“-style trackers pull player and match data that could plausibly be used to correlate who just finished a game with who to target next. Some affected players have found a partial workaround: switching on the client’s “streamer mode,” which hides recent match and online status information, appears to reduce how often bot requests arrive. Which is an indirect clue that the targeting relies on visible activity signals rather than random spam.
Unlike classic Discord scams that push fake Nitro codes or malware-laden “test my game” links to hijack accounts, this particular chain appears primarily aimed at driving paid subscriptions to an OnlyFans-style page of a fake AI girl. That doesn’t make it harmless. Even when the underlying OnlyFans account is real, the conversations are very likely run by paid chat operators or scripted/AI-powered systems working from a shared script and a reused media library, a business model that has been described by former OnlyFans “chatters” themselves: agencies assign staff (or bots) to respond as the creator around the clock, pull from a pre-made vault of photos and messages, and are financially incentivized to convert every conversation into a subscription or tip.
There are also more damaging variants layered onto the same funnel. Community reports describe some of these bot accounts eventually sending a link that, once clicked, is designed to hijack the recipient’s Discord account or harvest credentials rather than lead to legitimate content.
That means the “girl who wants to duo” opening can just as easily terminate in an account-takeover attempt as in a subscription upsell. Because the funnel starts with a low-cost, disposable Riot account and migrates the target to Discord within minutes, the League client friend request functions purely as a first-contact filter: cheap to generate, easy to discard after a single use, and outside the reach of Riot’s in-game reporting tools once the conversation moves off-platform.
How to stay safe
Recognizing these scams is the best way to protect yourself. But there is more you can do:
Treat any Riot client friend request from an unrecognized name as suspicious by default, especially one that arrives seconds after a match ends—check whether the account actually appeared in your last game before accepting anything.
Enable streamer mode or equivalent privacy settings in the Riot client to limit what activity and match data outside parties can see, which several affected players found reduced the frequency of these requests.
Be skeptical of anyone who quickly steers the conversation off-platform to Discord, especially if they cite being unavailable (“gotta go soon, here’s my Discord”) as the reason—this is a deliberate move to a channel with less moderation and no shared match context to verify identity.
Run a reverse image search (Google Images, TinEye, or a dedicated tool) on any profile or “personal” photos sent early in a conversation; recycled images across unrelated sites or forums are one of the most reliable tells of a bot or catfishing operation.
Watch for AI-typical conversation patterns: responses that feel scripted, arrive instantly regardless of time of day, are grammatically flawless but emotionally generic, or that consistently dodge voice/video calls.
Never send money, gift cards, cryptocurrency, or payment details to someone you met exclusively through in-game or Discord contact, no matter how convincing the rapport feels—legitimate connections do not require urgent financial “help” or exclusive subscription purchases within hours of meeting.
Do not click links sent by unfamiliar contacts, even ones framed as harmless subscription pages, game invites, or file downloads; some variants of this scheme are documented to lead to credential-stealing or account-hijacking pages rather than legitimate content.
Lock down Discord’s privacy settings (restrict who can DM you and send friend requests) and enable multi-factor authentication, since a compromised Discord account is often used to relaunch the same scam against the victim’s own friend list.
Report suspicious Riot client accounts to Riot Support and suspicious Discord accounts/servers to Discord Trust & Safety; reporting does not remove the account instantly but it feeds the pattern data that platforms use to detect and ban clusters of bot accounts.
If a bot or scripted persona pushes back convincingly against attempts to “break” it (e.g., ignoring prompt-injection or jailbreak-style messages designed to expose it as an AI), treat that resilience itself as a red flag rather than reassurance—a well-guarded script is not the same as a genuine person.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
OnlyFans creators are used to posting adult videos of themselves online, but what happens if someone takes control of their images and uses them for fraud? This week, USA Today revealed how criminals are impersonating OnlyFans creators using AI tools. They use deepfake content to lure the real models’ fans with fake promises of live chats, and then ghost them after the followers pay up in advance.
How the catfishers hook their bait
This is a form of catfishing, in which an attacker impersonates someone online and engages in romantic or sexual interactions for ulterior motives. In this case, the scammers create fake accounts on platforms like TikTok, using material lifted from a real creator’s photos and given a synthetic voice. They’ll use that to nudge viewers into a direct message conversation on services like Snapchat.
Once there, the “creator” asks for a Cash App payment in exchange for exclusive content. Cash App is a peer-to-peer payments service built for casual sends between friends, not for commerce. Transfers clear instantly and settle in the recipient’s balance within seconds. Once it’s been sent, it’s very difficult to recover.
That informal design is exactly what makes it useful here. As soon as the fan pays up, the criminal blocks them and disappears.
Why the laws don’t reach the actual servers
Lawmakers are tackling this with multiple state-level anti-deepfake bills. Federally, the Take It Down Act criminalizes non-consensual explicit content, including AI-generated images, and requires rapid platform takedowns. In the EU, the AI Act requires anyone who uses AI for image generation to disclose it publicly.
So why is this still happening?
The problem is that domestic laws only apply to domestic platforms. The stolen material largely sits on overseas hosts, making it difficult to control.
Even if laws could be universally enforced, it might not matter. In three experiments conducted this year, researchers at the University of Bristol found that most participants relied on deepfake content even after being told it was fake.
What actually helps
This kind of fraud has two victims: the fans who lose money to scams, and the creators. The latter lose income that they might have collected from fans, and also run the risk of retribution from disgruntled followers who think they’ve been taken advantage of.
One creator, Jessieanna Campbell, told USA Today that confused fans complained to her after mistakenly thinking she had taken their money. “I get messages all the time, like, ‘Hey, why did you take my $150 and block me?’ and I’m like, ‘What are you talking about?'”
USA Today also interviewed one creator who had angry fans visit her home, and is now sometimes scared to leave her house.
Some creators are hiring private content takedown services to try and fix the problem themselves. Others are posting public service announcements warning of these fake accounts. But it’s up to the fans to listen.
If a “creator” on a third-party platform contacts you, watch the video closely; the deepfakes are often flawed. USA Today reported that a TikTok video impersonating creator Elaina St. James, made by animating a still photo and cloning her voice, showed distorted teeth and frozen eyebrows. Here’s our guide to spotting deepfakes of any kind.
Common sense is the bottom line. If someone steers you into a direct messaging platform and solicits money for exclusive content, think twice. Check with the creator via a verified account to see if it’s real.
Scammers don’t need to hack you. They just need you to click once.
If you’ve spent any time browsing lately, you may have run into a full-screen popup warning you that your Apple ID or Amazon account was just used for a mysterious $149.99 purchase. It looks urgent. It looks official. And if you look at two examples side by side, it becomes obvious that it’s neither.
Below are two popups pulled from real pages—one dressed up as Apple Support, one as Amazon.
Same con, two costumes
Below, one popup is skinned as Apple Support, the other as Amazon. Swap the logo and color palette and the structure is identical: a warning icon, a claim that a $149.99 purchase was just made “via Pre-Authorization,” and a phone number to call immediately. That phone number is exactly the same in both.
Fake Apple alertFake Amazon alert
That reused phone number is the tell. If you only see one popup, running the number through a lookup tool like Malwarebytes Scam Number Check is usually enough to expose it—a real Apple or Amazon line won’t come back flagged, but a scam number typically does, often tied to complaints about several unrelated companies at once.
Why the copy is built the way it is
Every element in these popups is doing specific psychological work:
A believable, moderate dollar amount. $149.99 is high enough to alarm you, low enough to sound like a real subscription or product charge rather than an obvious lie.
“Pre-Authorization” jargon. This is real payment terminology (used for things like hotel holds or gas station charges), borrowed here to sound technically credible to someone who doesn’t handle payments professionally.
Manufactured urgency. “Call immediately,” “Immediate Action Required,” “no hold times”—all are designed to get you dialing before you stop to verify anything.
Visual authority. Red warning triangles, brand-matching fonts and layouts, and a full-screen modal that blocks the rest of the page all borrow the visual language of legitimate security alerts.
A single, frictionless call to action. One button, one phone number. The popup wants exactly one thing from you: to pick up the phone.
If you do call, the number connects to a live scammer posing as support staff, whose actual goal is to get remote access to your device, walk you through “verifying” your identity in a way that hands over real account or payment info, or push you toward paying a fake fee—often via gift cards or a wire transfer.
How to tell if it’s fake
A few checks work regardless of which brand is being impersonated:
Real companies don’t alert you this way. Apple and Amazon notify you about account activity through email, in-app notifications, or your account’s activity log—never through an unexpected popup while you’re browsing.
No legitimate company tells you to call a phone number to stop a charge. Disputing a charge happens through your bank, your card issuer, or the company’s actual account dashboard—not a hotline dictated by a popup.
Check where the popup is actually served from. These often ride in on malicious ads, compromised sites, or browser redirects—the underlying page may be spoofed or injected, not the real apple.com or amazon.com support page it appears to sit on top of.
A popup you can’t easily close is a red flag on its own. Legitimate sites don’t need to trap you behind a full-screen modal to relay account information.
If in doubt, go direct. Close the tab (force-close via task manager if needed) and navigate to the company’s site yourself, or call the number printed on your card or official account page—never the one in the popup.
Check the number before you dial it. Run it through Malwarebytes Scam Number Check to see if it’s already been flagged as a scam line.
Block it before it loads. A browser extension like Malwarebytes Browser Guard catches both known malicious pages and unknown ones showing scam-like behavior, so these popups often get stopped before they ever render.
Don’t judge a scam by its logo
The brand on screen—Apple, Amazon, or whoever’s next—is the least important part of this scam. What actually matters is the pattern underneath: an unexpected popup, a suspiciously specific dollar amount, urgent language, and a phone number that wants you to call before you think. Once you recognize that pattern, it doesn’t matter which company’s name is stamped on top of it.
A scam is spreading through WhatsApp with the goal of taking over victims’ accounts entirely.
It starts with a message that feels harmless and familiar. Someone—often a contact whose account has already been compromised—asks you to support a friend or relative of theirs by voting in an online contest. The theme varies: a ballet performance, a dog competition, a school event. The wording is casual, sometimes urgent, and designed to get a quick click.
We spotted the scam showing up in our anonymized Scam Guard submissions. WhatsApp is popular with cybercriminals, and the third most common channel where we see scams delivered, behind websites and email.
At first glance, nothing seems out of the ordinary. But the link doesn’t lead to a real voting page. Instead, it redirects to a page that appears to be related to WhatsApp, often involving the legitimate wa.me domain, where the real attack begins.
This scam works because it combines trust and curiosity. If the message comes from someone you know, you’re far less likely to question it and far more likely to follow through to do them a small favor.
In some versions of the scam, the link redirects you into a flow that abuses WhatsApp’s legitimate “Linked devices” feature.
Depending on your device, you may see what looks like a WhatsApp page prompting you to continue, verify, or connect. In some cases, the victim is guided through steps that resemble setting up WhatsApp Web or linking a new device.
The goal is to trick you into authorizing a new linked session that gives the attacker access to your WhatsApp account.
A typical flow looks like this:
You tap the “vote” link.
A page opens that appears to be related to WhatsApp.
You’re prompted to complete a connection or verification step.
That action links your WhatsApp account to a device controlled by the attacker.
Some versions of this scam take a less direct route. Instead of sending victims to a fake voting page, the message or the landing page instructs victims to open WhatsApp, go to “Connected Devices,” and enter a code supplied by the scammer.
These scammers aren’t trying to steal your password. Instead, they’re tricking you into giving them access to your account yourself.
How WhatsApp’s Linked devices feature works
WhatsApp allows you to use your account on multiple devices, including a web browser or desktop app, through its Linked devices feature.
Normally, this works by:
Opening WhatsApp on your phone.
Scanning a QR code displayed on another device.
Approving the connection.
Once linked, that secondary device can:
Read your messages.
Send messages as you.
Access your ongoing conversations in near real time.
But if you follow those steps, you could be giving an attacker access to your messages, contacts, and ongoing conversations.
This is a legitimate and widely used feature, especially for WhatsApp Web. But in this scam, attackers abuse it to gain the same level of access without your informed consent.
Once a scammer links their device to your WhatsApp account, they can continue accessing your conversations until that device is removed.
From there, they can:
Send messages pretending to be you, including forwarding the same scam to your contacts.
Ask friends or family for money or sensitive information.
Read your chats and harvest personal information.
Because this doesn’t involve a traditional login, there are no obvious signs like password reset emails or failed login alerts. The attacker’s device simply appears as another linked session on your account.
Unless you check your linked devices, the compromise can go unnoticed for quite some time.
How to stay safe
Scams like this rely on quick reactions and misplaced trust. A few simple precautions can make a big difference:
Be cautious with unexpected “vote” or “support” requests, even if they come from someone you know.
Don’t click unexpected links, especially if you’re immediately asked to verify, connect, or link your WhatsApp account.
Never follow instructions to link devices or scan QR codes unless you initiated the action yourself.
Regularly review your linked devices in WhatsApp (Settings > Linked devices) and log out of any you don’t recognize.
If a message feels off, verify it with the sender through another channel before acting.
Malwarebytes Scam Guard can also help spot scams like this. It’s included with the Malwarebytes Mobile Security app for Android and iPhone.
If you suspect your account has already been compromised, immediately log out of all linked devices and warn your contacts so they don’t fall for follow-up scams.
Indicators of Compromise (IOCs)
These domains are typically short-lived and quickly replaced. However, they may help you recognize similar scams if you encounter them:
Search for certain combinations of “TikTok” and adult content, and sooner or later you’ll land on a page promising exactly what you searched for: an endless feed of explicit clips, no signup required, just tap and watch.
There isn’t one.
On the other side of that click is an ad funnel dressed up as exclusive content.
These pages aren’t connected to TikTok itself. They simply exploit the platform’s name to attract search traffic. TikTok’s huge user base, and the number of people searching for adult content associated with the platform, make it an attractive lure both for advertisers and scammers.
What you need to know right away
Nothing on these pages is genuine content pulled from TikTok. Their entire business model is get you to click, sign up, or install something.
The operators don’t need to host any videos to make money. The promise of exclusive content is enough to generate clicks, signups, and downloads.
Although you’re probably not going to lose your life savings here, you could well end up on a spam list, installing an unwanted app, or paying for an “age verification” that doesn’t verify anything.
A pitch built around your search
These pages are designed to match exactly what you searched for. Many are built to rank for popular search terms in Google and other search engines, rather than relying on visitors coming from TikTok itself. They often acknowledge the frustrating hunt for working links before presenting themselves as the solution.
Below that, you’ll usually find a deliberately blurred video thumbnail, reassuring labels like “18+ only” and “HD clips,” and one or two buttons inviting you to Start watching or Sign up for free.
Mirroring the visitor’s own search behavior back at them is a common tactic in this category of ad-lure page. It’s designed to make the offer feel more relevant rather than generic.
What happens after you click varies from site to site, but you rarely get the content you were promised. Instead, you’re likely to be redirected through advertising networks, asked to hand over an email address or payment card for “age verification,” or prompted to install an app from outside the official app stores.
Each click or redirect can earn the site operator money through advertising or affiliate commissions, even if you never sign up or download anything.
Every step of the journey has value: A click can generate advertising revenue, a signup can earn an affiliate commission, and an email address can be sold or added to marketing lists. A payment card entered for “age verification” can lead to recurring subscription charges. Whether you ever see a video is irrelevant because the site has already achieved its goal.
Legitimate websites don’t normally need your payment card to prove you’re over 18. Fake “age verification” pages often use the process to collect card details, sign people up for recurring subscriptions, or both.
There’s no content, but there is a funnel
The blurred thumbnail is the entire “product.” It’s designed to look like a legitimate preview, suggesting there’s something just behind the next click, even though there usually isn’t. The site makes money from the clicks, signups, and downloads, not from any videos.
Depending on the page, the operator makes money in several ways:
Affiliate commissions. You click through to a dating site, adult subscription, VPN, app, or other offer. If you sign up, the site owner gets paid.
Advertising revenue. Every redirect, pop-up, or ad impression earns money.
Lead generation. Your email address is collected and sold or used for spam and phishing.
Subscription traps. “Age verification” asks for a payment card, then quietly enrolls you in a recurring subscription.
Potential malware. Some pages push unwanted software or even malware outside official app stores.
Why this lure works
Adult content lures carry a built-in advantage most scams don’t have: embarrassment. People are less likely to mention it to a friend, ask for a second opinion, or report it, which means fewer eyes catch the scam before it spreads further.
What to do
Close the tab. There isn’t any exclusive TikTok content waiting behind Start watching.
Don’t enter your email address, payment card, or date of birth to verify access. It isn’t verifying anything, it’s collecting data.
Don’t install anything you were prompted to download from a page like this.
If you’ve already entered information, treat it as exposed. Watch for follow-up spam or phishing emails, and change any passwords you may have reused.
Adult-content lures are one of the oldest tricks in malvertising. Using TikTok’s name just makes them feel more relevant to today’s searches.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Fortnite scam pages like the ones below appear by the dozen every day, recycled endlessly under different names and designs.
One version promises $50 from a fake superhero collaboration. Another claims it can calculate what your locker is worth. Both lead to the same destination: a fake Epic Games login page designed to steal your account. It’s an old trick, but it still catches people out.
The short version
If a website promises free V-Bucks, cash, or a tool to calculate your locker’s value, then asks you to log in with your Epic account to get it, it’s not run by Epic.
Epic doesn’t offer an official tool that values accounts, and no legitimate giveaway requires you to sign in through a third-party site. You’re just handing your Epic username and password to scammers.
If you or your child entered your Epic login details on one of these sites, assume the account has been compromised. Change the password immediately, turn on two-factor authentication, and don’t reuse that password on any other accounts.
Why do they want your login?
A stolen Fortnite account can be worth real money. Criminals can take over accounts with rare skins, spend any saved payment methods, sell the account on underground marketplaces, or use it to scam the owner’s friends. They may also try the same username and password on other online accounts, hoping the password has been reused.
Why Fortnite?
Fortnite still attracts around 110 million monthly players and has more than 650 million registered accounts. That alone makes it an attractive target for cybercriminals.
The audience’s age matters too. In December 2022, the US Federal Trade Commission (FTC) fined Epic Games a record $520 million, after alleging that the company knew children made up a substantial share of its player base and left voice and text chat turned on by default, exposing them to strangers. The Consumer Financial Protection Bureau (CFPB) also cites industry experts who say young gamers are especially vulnerable to phishing because they spend more time on social media and are less familiar with social engineering.
The game is also built around visible status. Skins, emotes, and pickaxes cost real money, making the idea that “your locker has a price” feel plausible. Rare or discontinued skins really do sell for hundreds of dollars on unofficial marketplaces, even though Epic offers no official way to cash out V-Bucks and selling accounts violates its terms of service. That kernel of truth is exactly what these locker-value scams exploit.
That’s also what makes them more convincing than a simple V-Bucks giveaway. Instead of promising something for nothing, they play on curiosity about something the player already owns. That’s probably why this version keeps coming back.
How the scam works
Some pages promise rewards:
Others skip the free-reward pitch and frame the locker itself as hidden value the player is owed:
Others frame it as competition instead of currency:
The hook changes, but the fake login page doesn’t. These sites all do the same thing. They ask you to sign in with your Epic account so they can steal your username and password.
Another variant: Fake settlement claims
This one borrows a real story. Epic did settle with the FTC for $520 million, and real payments are still going out in 2026. But the real settlement pays actual dollars through the FTC’s own process, not in-game V-Bucks through an “Epic Games Locker,” and the claim window closed in July 2025.
References to an “EU Regulatory Mandate” and the case number shown on these pages don’t match any genuine legal action.
How to stay safe
Fortnite scams change constantly, but the advice doesn’t.
Use Malwarebytes Browser Guard to block known phishing sites before they have a chance to steal your login details.
Only sign in to your Epic account at epicgames.com. If another website asks for your Epic login, leave.
Be sceptical of offers that sound too good to be true. Free V-Bucks, locker valuations, and surprise rewards are all common phishing lures.
Verify refunds and settlements on the official source. If a page claims you’re owed money, check the regulator’s website yourself instead of following its links.
Turn on two-factor authentication (2FA). It can stop attackers from accessing your account even if they steal your password.
Use Malwarebytes Scam Guard. It can help you identify suspicious links and messages before you click.
What to do if you clicked
Change the Epic password immediately, going directly to epicgames.com, not through the suspicious link.
Turn on two-factor authentication if you haven’t already.
Check your linked email for password reset requests or login alerts you didn’t make.
Review connected devices/services on the account and remove anything unfamiliar.
If you entered payment details anywhere, contact your card issuer and monitor your statements.
Report the page to Epic’s support and flag it as phishing in your browser.
If the page claims to be part of a settlement or refund, verify it on the regulator’s official website. For the Epic settlement, that’s ftc.gov.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
A whole industry has sprung up around selling TikTok “growth.”
Cheap views by the hundred, pre-made ad accounts, and polished sales pages promising a repeatable path to serious revenue.
None of it is officially sanctioned by TikTok, and depending on what you’re buying, you could end up wasting money, losing your account, or handing your login details to scammers.
Scam 1: Sites selling cheap likes and engagement
Sites selling bulk engagement all look remarkably similar.
They offer small bundles of views, likes, or followers for a few pounds, usually alongside identical packages for YouTube, Instagram, and other platforms.
The sales pitch is almost always the same: “100% real profiles,” “no bots, no click farms,” and “completely safe.”
Those claims are worth reading carefully because they’re addressing the biggest concern buyers already have.
At this price point, bulk engagement is usually generated through bots, click farms, or other artificial means—the very thing these sites insist they don’t use.
Even if your engagement numbers increase initially, TikTok’s fraud detection systems can remove artificial engagement, and accounts that repeatedly use these services risk being flagged or restricted.
Scam 2: The “aged” ad account marketplace
Another common offer is bulk TikTok Ads accounts sold as “aged” or “trusted,” often bundled with a replacement guarantee if an account stops working. The pitch is that you skip the hassle of setting up and verifying a new advertising account.
The problem is that you don’t know how those accounts were created. Many are built using stolen or synthetic identities, compromised payment details, or other deceptive methods. Buying one means inheriting that history—and the very real risk that TikTok detects it and suspends the account, along with any campaigns or ad budget attached to it. A replacement guarantee won’t help if your advertising is suddenly brought to a halt.
Scam 3: The growth framework
A third type of offer is less obviously a scam and more of a marketing funnel.
Slick landing pages—often hosted on free platforms and paired with an embedded video—promise a “proven blueprint” for turning TikTok into a major source of income, usually backed by impressive but unverifiable claims about past clients.
The immediate goal is usually to collect your email address, and sometimes your phone number, before revealing what’s actually for sale. That might be a paid course, a “done-for-you” management service, or a request for direct access to your TikTok Shop or Ads account.
What happens next varies, but the common thread is the same: you’re being asked to trust an unverified third party with your business, your money, or your account.
What you’re really signing up for
Not every TikTok marketing service is a scam. But if someone’s offering thousands of views for a few pounds, bulk “aged” ad accounts, or guaranteed growth, you’re in a very different part of the market.
These services promise shortcuts. What they often deliver is fake engagement, accounts with questionable histories, or requests for access to your own account.
At best, you’ve wasted your money on engagement TikTok later strips away. At worst, you’re buying an account built on stolen information or giving an untrusted third party full access to your own.
Our advice
Don’t pay for views, likes, or followers. Artificial engagement isn’t real growth and can put your account at risk under TikTok’s rules.
Never share your TikTok username and password with a “boosting” service, regardless of how it’s presented.
Don’t buy or sell TikTok Ads or Business accounts outside TikTok’s own account creation process.
Treat “guaranteed revenue” frameworks and courses like any other business opportunity: they’re sales pages first, educational content second.
None of this is unique to TikTok. The platform’s explosive growth has simply given a familiar ecosystem of low-effort scams a new audience.
Scammers don’t need to hack you. They just need you to click once.
Shoppers browsing on their phones are landing on convincing Walmart lookalike sites offering name-brand liquor at 40% to 70% off, only to be led straight to a checkout page asking for a full credit card number, expiry date, and CVV.
The sites have no connection to Walmart. They’re part of a network of more than 120 near-identical domains built to look like a legitimate retailer just long enough to steal your card details.
Fake Walmart websites
The name “Walmart” is doing most of the work here. It’s one of the most recognized retailers in the world, and it’s that familiarity that makes people lower their guard. A shopper who’d hesitate on an unfamiliar website may think nothing of an unusually large discount because the logo, colours, and layout look familiar.
That trust hasn’t been earned by the site. It’s borrowed from a brand that has nothing to do with it.
If you’ve entered your card details on one of these pages, the safest assumption is that your card has been compromised.
How the scam works
The scam follows a simple pattern: a Walmart-branded homepage, category pages stacked with heavily discounted liquor, and a checkout form asking for full card details.
The discounts do much of the persuading. Seeing premium brands advertised at 60% or 70% off encourages people to buy first and ask questions later.
The same WordPress/WooCommerce template powers every site in the network. They share the same product catalogue, prices, and images. The only differences are fabricated US business addresses and phone numbers that are swapped out for each domain.
How to avoid this scam
Be sceptical of discounts that don’t match a retailer’s usual promotions, especially on liquor or electronics.
Check the address bar before entering payment details. A genuine Walmart sale won’t send you to an unfamiliar .shop domain.
Use tools that can identify scam websites automatically, such as Malwarebytes Browser Guard on desktop, or ask Scam Guard if it thinks a domain is suspicious.
On mobile, where these sites are designed to work, Malwarebytes Mobile Security can block known phishing and scam domains before you reach the checkout.
If you already entered your card details
Contact your card issuer immediately. Explain what happened and ask whether the card should be cancelled and replaced.
Watch your account for unauthorized charges, including small “test” transactions.
Report the domain through your browser’s phishing reporting feature and to the FTC at reportfraud.ftc.gov if you’re in the US.
The simplest defence is also the most effective: if a retailer needs a lookalike domain to sell you something, it’s probably a scam.
Employment scams are increasingly being used to target job seekers, with the FBI and LinkedIn joining forces to educate applicants about fraudulent job opportunities and the warning signs of potential exploitation. The FBI's Internet Crime Complaint Center received 24,688 reports of employment scam victimization in 2025, with nearly $363 million in reported losses.
The FBI defines employment fraud as a scheme designed to deceive someone into believing they have been, or could soon be, hired for a job. However, officials warn that these schemes are not always focused on stealing money from victims. They can also be used to recruit money mules, collect personally identifiable information, or force people into labor.
Employment Scams Exploit Trust in Job Opportunities
LinkedIn, which has more than 1.3 billion members across more than 200 countries and regions, said people submit approximately 10,000 job applications every minute on the platform.
The company uses automated systems and human oversight to detect and remove fraudulent activity. According to LinkedIn, automated defenses remove 98.7% of detected spam and scam content before members see it, while 99.5% of detected fake accounts are stopped proactively.
LinkedIn also uses verification indicators to show when certain information about people, companies, recruiters, and candidates has been confirmed.
Despite these measures, the company said scammers are becoming more sophisticated, with artificial intelligence making it cheaper, faster, and easier to impersonate legitimate individuals.
One warning sign highlighted by LinkedIn is when a recruiter or company representative attempts to move a conversation away from LinkedIn's messaging platform. Doing so can allow scammers to bypass the platform's protections and reporting tools.
Money Mule Scams Turn Job Seekers Into Financial Intermediaries
One major form of employment scams involves recruiting victims as money mules. Scammers may advertise legitimate-sounding positions such as cryptocurrency transaction specialist, accounts receivable assistant, remote financial coordinator, or payment processing agent.
After being hired, victims may receive money in their personal bank accounts, often through peer-to-peer payment applications. They are then instructed to withdraw the funds, convert them into cash, gift cards, or cryptocurrency, and transfer them elsewhere in exchange for a small commission.
The money is generally linked to other scams or compromised accounts. Victims may face legal consequences, account closures, and seized funds despite being deceived into participating.
Stolen PII Employment Scams Target Personal Information
Another type of fraud uses fake employment opportunities to collect stolen PII. Job titles may include onboarding specialist, HR assistant, compliance reviewer, or know your customer and identity verification agent.
Victims may be asked to collect identity documents from customers, forward files, verify accounts, handle one-time codes, open accounts, submit applications, or organize data into spreadsheets and shared drives.
Instead of directly moving stolen money, victims become part of a process designed to harvest personal information.
Forced Labor Can Begin With a Fake Job Offer
The FBI also warns that some employment scams can become gateways to human trafficking and forced labor. Victims may be offered jobs abroad or remote positions and encouraged to travel internationally, with Southeast Asia identified as a known hotspot.
After arriving, victims may have their passports confiscated and be told they must repay travel costs. Some are then forced to work in scam compounds, where they are required to contact targets. Victims may face monitoring, threats, or physical abuse if they fail to meet quotas.
FBI Warns Job Seekers About Employment Scam Red Flags
The FBI and LinkedIn advise applicants to research companies carefully and watch for warning signs.
For money mule scams, red flags include requests to use personal bank accounts for business transactions, bypass normal payroll systems, move money quickly, open new accounts, or use cryptocurrency and gift cards.
For scams involving stolen PII, applicants should be cautious if they are asked to handle sensitive identity documents without a legitimate compliance structure, receive files through informal channels, or are pressured to bypass normal safeguards.
Potential forced labor scams may involve unusually high pay for vague overseas jobs, demands for quick relocation, employer-controlled travel arrangements, vague contracts, early moves to encrypted messaging apps, or instructions to keep the job secret from family.
The FBI and LinkedIn said educating job seekers can help disrupt employment fraud before victims become involved. Anyone who believes they have been targeted should contact their financial institution immediately and report the incident to the FBI's Internet Crime Complaint Center with as many details as possible.
Sextortion scammers are using email addresses from data leaked by the ShinyHunters hacking group to add some credibility to their feeble attempts to convince people they have embarrassing information about them.
Sextortion emails are messages claiming that the scammer recorded you through your webcam while you watched pornography and now demand payment. They have been around for years and keep evolving with small changes in wording and fake technical detail.
In this campaign, the scammers pretend to be ShinyHunters. What hasn’t changed is the basic truth: there is no malware, no recording, and no credible evidence behind the threat. Despite seeing countless versions of these emails over the years, I’ve yet to encounter one that was backed up by the evidence the sender claimed to have.
BleepingComputer reports that ShinyHunters data leaks are fueling a $2,000 sextortion email scam and shared the following example:
“Subject: Information about your online security
Hello,
We are the ShinyHunters hacking group. A few months ago, we gained access to your devices and started monitoring your online activities.
What happened: We gained access to the Amtrak.com database where you have an account and easily accessed your email. You weren’t very careful about the links you opened. A week later, we installed an exploit on your devices, including your phone, giving us access to your microphone, camera, keyboard, and all your data. We have your photos, browsing history, conversations, and contact list.
Among other things, we discovered that you frequently visit adult websites and watch explicit videos. We managed to record you and created videos of you pleasuring yourself. With a few clicks, we can share these videos with your friends, colleagues, and family or even make them public.
Proposal: Send us $2000 in Bitcoin to the following wallet: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
We’ll delete everything immediately. You have 48 hours from the moment you open this email. Once the payment is received, we’ll remove the malware from your devices.”
BleepingComputer states it has seen data from the Amtrak, Hallmark, ADT, Substack, Betterment, CarGurus, Panera Bread, and McGraw Hill breaches used to target victims in this sextortion email campaign.
A California community college also issued a warning after seeing the campaign target people affected by the Canvas data breach.
They confirmed that the targeted email addresses had previously appeared in data leaked by ShinyHunters. They also contacted the group, which denied being behind the sextortion emails.
The increase to a $2,000 demand may suggest the scammers paid someone for the email lists. Although it’s more likely they simply downloaded the leaked data after ShinyHunters published it following failed extortion attempts.
A quick check of the Bitcoin address used in the email shows no activity.
No activity on their Bitcoin address
Let’s keep it that way. With any luck, these dungeon dwellers will eventually give up trying to scare people out of their hard-earned money.
How to react to sextortion emails
Some sextortion emails are badly written, but many have been polished by AI and look convincing. Regardless of how professional they look, they should be treated the same way: as unsubstantiated threats designed to scare victims into paying.
First and foremost, never reply to emails of this kind. Responding confirms that someone is actively reading messages sent to that address and may encourage further scam attempts.
Don’t let yourself be rushed into action. Scammers rely on the fact that you will not take the time to think this through and subsequently make mistakes. Ask for advice if you’re not sure.
An attachment is not proof. Most sextortion emails contain no evidence at all, and attachments are often used to deliver malware or make the threats appear more convincing.
If the email includes a password you’ve used before, change it immediately anywhere it’s still in use. Then enable two-factor authentication (2FA) wherever possible. If you’re having trouble keeping track of your passwords, consider using a password manager.
Delete the message, report it as spam, and move on.
Pro tip: Malwarebytes Scam Guard recognized this email for what it is: sextortion. It can recognize scams and advise you how to proceed.
While these sextortion emails are almost always bluffs, if you’re concerned about webcam spying, Malwarebytes Webcam Monitoring can alert you when applications attempt to access your camera.
Resin art has become a popular corner of TikTok, with some videos attracting millions of views. But not every glossy, colorful post is what it claims to be. Scammers are using the look of handmade resin art to trick buyers, collectors, and even fellow artists into sending money for work that either doesn’t exist or wasn’t created by the person posting it.
There are plenty of genuine resin artists on TikTok. Unfortunately, the platform has also attracted scammers who steal videos and impersonate legitimate creators.
The scam is fairly straightforward. A TikTok account presents itself as a resin artist, posts satisfying videos, and invites people to “DM to order.” In some cases, the videos are stolen from other creators, the account has no real process footage, and the seller disappears after receiving payment.
One resin artist discovered that scammers were using their videos to impersonate them and scam TikTok users. They shared the following comment:
Ridiculous TikTok scammer…lol. Profile says they’re a resin artist and to DM them to order, but none of the videos are theirs. When I wrote to them asking them to take down the many videos of mine that they posted, passing them off as their own with no credit, their answer was that they aren’t a resin artist and are just sharing videos they like Literally about 1/4 of “their” videos are mine
These scams often rely on trust and urgency. The account may show polished clips of poured resin, finished coasters, trays, jewelry, or wall art, then push buyers to move the conversation into direct messages. Once the buyer moves to a different platform, the scammer typically requests a deposit, full payment, or personal details with little chance of being held accountable.
And real artists don’t just get their work ripped off. A scammer may contact a creator claiming to want to buy, feature, or license their work, but the real goal is to extract fees, banking information, or other sensitive data. Social media art scams are often repetitive because they are built from the same templates and scripts.
Different videos, same script
How to spot a TikTok resin art scam
The safest approach is the boring one: verify before you pay. If the artwork looks amazing but the seller’s identity is vague, the risk is real.
Check the TikTok account
Before ordering, look for signs that the artist is genuine:
The account didn’t appear overnight and has a history of original posts.
The same videos don’t appear under multiple creator names or belong to another artist.
The creator shows themselves making the artwork, with consistent process videos, a recognizable workspace, and works in progress.
The videos don’t contain obvious AI artifacts, such as impossible resin effects or objects moving after they’ve supposedly been sealed inside hardened resin.
Comments raising concerns haven’t been deleted or buried under generic praise.
The seller isn’t pushing you to order only through direct messages or asking for payment before you’ve verified who they are.
Check the website
If you do click through to a website, spend a few minutes checking it before you buy:
Look for a genuine returns and refunds policy, a physical business address, company or VAT details (where applicable), and consistent contact information.
Check how old the website is. Scam sites often use domains that were registered only weeks or months ago, especially when they claim to have been selling handmade products for years.
Search for recent independent reviews rather than relying on testimonials published on the site itself.
Run a reverse image search on the product photos to see whether they’ve been copied from another artist.
Only pay using a method that offers buyer protection, such as a credit card or PayPal. If a seller insists on a bank transfer, cryptocurrency, or another irreversible payment method, walk away.
Not every resin art account is a scam. Many belong to genuine artists, and that’s why impersonation scams can be so convincing.
If you’re unsure, paste the website address into Malwarebytes Scam Guard and ask whether it shows signs of being fraudulent. It can help identify suspiciously new domains and other common scam indicators.
Use real-time web protection to block known fraudulent and malicious websites, like Browser Guard did for this web shop:
Browser Guard blocks the fraudulent website
Both are free—making them much cheaper than sending money to a scammer.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Call of Duty Mobile players should watch out for a phishing campaign disguised as a free Call of Duty Points giveaway.
Victims are asked to log in with their email address and password to claim free Call of Duty Points (CP), the game’s premium currency. They’re then redirected to a second page asking for their two-factor authentication (2FA) code.
The site has no connection to Activision. Its only purpose is to steal the login details needed to take over accounts.
Why Call of Duty Mobile accounts are worth stealing
Call of Duty Mobile has been downloaded an estimated 489 million times worldwide and has generated around $1.8 billion in lifetime in-app purchases.
An Activision account can be valuable for more than just the in-game currency it contains. Many players link their Activision account to Xbox, PlayStation, or Battle.net, meaning a stolen login could expose:
Stored payment methods
Purchase history
Other linked gaming accounts
How the scam works
The first page mimics the official Call of Duty Mobile site and offers 10,800 free points in exchange for an email address and password—not a redemption code, but a full account login. It also claims the reward will be “confirmed” within four to eight hours, buying time before anyone notices nothing has arrived.
There are warning signs, though. The page says “GET FREE POINT” instead of “GET FREE POINTS,” contains awkwardly worded instructions, and includes a live chat widget that appears to exist solely to make the site look more legitimate.
The redirect follows a common phishing technique known as a real-time credential relay. Instead of storing stolen usernames and passwords for later, the phishing site immediately submits them to the real Activision login page. That can trigger a genuine two-factor authentication (2FA) code, which the second page is designed to capture before it expires.
The victim ends up handing over everything needed to access their real account: their password and the one-time code that’s supposed to keep attackers out.
How to avoid this scam
Check the address bar. Legitimate promotions don’t ask you to sign in through an unfamiliar website.
Don’t let countdown timers rush you. They’re designed to make you act before you think.
If you’re unsure whether a promotion is genuine, open the official Call of Duty Mobile app or visit Activision’s website yourself instead of following a link.
If you play on your phone, Malwarebytes Mobile Security adds another layer of protection by helping block phishing sites and other mobile threats.
If you already entered your details
Change your Activision password immediately.
If you entered a 2FA code, assume someone may have accessed your account. Check your account activity and sign out of all devices.
Review any linked payment methods for unauthorized purchases.
The simplest way to avoid phishing attacks like this is to reach websites yourself by typing the address into your browser or using the official app, rather than following links from messages, social media posts, or ads.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
The Federal Bureau of Investigation’s (FBI) Internet Crime Complaint Center (IC3) is warning that scammers are impersonating the bureau on social media and on messaging apps, targeting people who’ve already been victims of cybercrime.
The FBI has issued warnings like this before, but scammers posing as IC3 employees and FBI agents continue to evolve their schemes and claim new victims.
The best-known of these scams are recovery scams, complete with FBI logos and branding that make them look far more convincing.
Facebook accounts like the one below—and yes, I reported it—with equally fake reviews prey on people who have already fallen victim to a scammer.
“Have You Been Scammed or Defrauded? We’re Here to Help.
If you’ve fallen victim to online fraud, investment scams, crypto scams, romance scams, or unauthorized transactions, Reliable Scam Recovery Inc is ready to assist you in pursuing the recovery of your lost funds.
Our experienced recovery team works with victims to investigate scam activities, trace transactions, and provide guidance throughout the recovery process with confidentiality and professionalism.
Professional case assessment
Secure and confidential support
Dedicated recovery assistance
Fast response team
Don’t let scammers win. Take the first step toward reclaiming your losses today.
Contact Ic3 Scam Recovery Inc now for support and recovery assistance.”
The scammers count on victims feeling desperate and embarrassed. They have no scruples about victimizing them all over again.
The post contains a lot of the tell-tale signs IC3 warns about. Very vague but reassuring claims: “experienced recovery team,” “professional case assessment,” “secure and confidential support” all sound impressive but provide no verifiable detail. High‑level promises like “investigate scam activities” and “trace transactions” imply special legal or technical powers, but the FBI warns that scammers make similar promises to convince victims they’re dealing with authorized investigators.
Besides setting up fake IC3 accounts, they also monitor social media for posts from victims saying they’ve reported a scam to the FBI, then swoop in posing as FBI follow‑up contacts.
If victims remain unconvinced, the scammers may create videos depicting senior FBI officials or other recognizable public figures urging them to submit their case through a specific link “to speed up recovery.” The FBI says criminals are increasingly using AI-generated deepfake audio and video to make these messages appear genuine.
How to stay safe
First and foremost, remember that IC3 has no official social media presence, does not investigate crimes via social media, and will never contact victims directly to recover funds.
“The IC3 does not work with any non-law enforcement entity, such as law firms or crypto services, to recuperate lost funds or investigate cases. The IC3 will never directly contact you for information or money.”
So, if an “agent” appears in your direct messages (DMs) right after you post publicly about being a crime victim or planning to report to the FBI, assume they are a scammer until independently verified. A few other tips:
Never pay upfront: Legitimate government agencies never ask you for advance payment to recover stolen money.
Ignore unsolicited claims: Be highly suspicious of anyone who reaches out to you out of the blue claiming they can reverse a previous scam.
Never share your credentials: Do not give remote access to your device or hand over your passwords and recovery phrases to unknown third parties.
Don’t provide IDs or financial information. Scammers can use them for identity theft or further fraud.
Use verification tools: If you receive a suspicious email, message, or phone call, you can verify its legitimacy using tools like Malwarebytes Scam Guard.
Report scammers: If you or someone you know has fallen victim to this scam, file a complaint with the IC3 at ic3.gov.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Christopher Nolan’s The Odyssey is one of the biggest movie releases of the year and scammers wasted no time taking advantage of it. Within hours of the film’s release, we found scams targeting people looking for pirated copies. Some used fake browser warnings on piracy sites, while others disguised malware as movie downloads.
Some used fake browser error messages designed to funnel people through malvertising networks. Others offered what appeared to be movie downloads that were actually Windows executables disguised as video files.
Neither scam has anything to do with the movie itself. They’re simply taking advantage of people searching for a popular new release.
The Odyssey piracy scams we found
We observed two main tactics.
One used fake pop-ups claiming your browser was missing a required “component.” Clicking Fix It Now didn’t solve any problem. It simply routed visitors into a malvertising network. Exactly where those redirects ended depended on whatever campaign the network was serving at the time.
The second involved a file advertised as The Odyssey 2026 1080p WEBRip-LAMA. Once downloaded, however, it turned out to be an .exe file. That’s a Windows application, not a video.
Movies don’t need to run as programs. If a supposed movie download ends in .exe, it isn’t a movie.
The fake “Browser Issue Detected” warning
On cloned piracy sites listing The Odyssey torrents, we encountered a fake browser pop-up claiming Browser Issue Detected. It warned that a “missing component” was preventing full access. It presented a prominent Fix It Now button, with a much smaller Close and Continue Browsing option underneath.
There was no missing browser component. The entire pop-up was part of the webpage itself, designed to look like a genuine browser warning.
What made this particularly interesting was how consistently it appeared. We found the same overlay—identical wording, identical layout, with only the branding colors changed—across multiple cloned torrent sites.
These were not the genuine torrent trackers, but convincing copies designed to impersonate well-known piracy sites that reproduced real listing layouts, artwork, and cast information for The Odyssey, then displayed the fake browser warning on top. Taken together, the cloned websites and identical pop-ups strongly suggest a coordinated campaign built to capture searches for a major new release, rather than legitimate torrent sites that had been compromised.
Clicking Fix It Now typically sends visitors through one or more advertising redirects. Depending on which campaign is active at that moment, users may eventually land on:
A fake browser extension
Scareware urging them to call a fake technical support number
Another redirect attempting to deliver malware
The final destination can vary from one visit to the next because the underlying ad network changes what it serves over time.
A movie that was actually a program
The second scam targeted people who actually tried to download the movie. We also found a listing named The Odyssey 2026 1080p WEBRip-LAMA.exe, advertised as a 1080pWEBRip release with 597 seeders and 520 leechers.
Windows immediately identified the download as an Application, confirming what the file extension had already revealed.
Legitimate movie downloads use video containers such as .mkv, .mp4, or .avi. These files are opened by a media player, they do not execute code.
Several other details stood out.
The file description read “wireless bus Business Controller,” which has nothing to do with video playback and was likely leftover metadata from whatever software was originally used to build the executable.
The file also displayed VLC Media Player’s familiar orange traffic cone icon, despite being an application rather than a video file. That’s a classic social engineering trick. VLC is one of the world’s most widely used media players, so many people instinctively associate its icon with a harmless video. In a downloads folder, the file looks like something you can safely double-click when, in reality, doing so executes an unknown program with your own user permissions.
Files packaged this way (with misleading extensions, spoofed icons, and inconsistent metadata) are a well-established malware delivery technique.
What runs after the user launches the file depends on the campaign. It could be:
A Trojan that opens a backdoor into the system
An infostealer that steals saved passwords and browser sessions
A loader that downloads additional malware
In some cases, ransomware
It’s also worth remembering that large numbers of seeders don’t prove a file is safe. They only indicate that many people are sharing it, and plenty of people unknowingly distribute malicious files.
Why these scams work
Neither scam relied on exploiting a software vulnerability.
Instead, both relied on convincing someone to take the next step: clicking a fake browser warning or running what they believed was a movie.
That’s much harder for security software to prevent completely, because browsers can’t reliably distinguish between a genuine browser message and one rendered entirely in a webpage’s HTML. Likewise, antivirus software can’t flag every executable simply because it uses a misleading icon or contains unusual metadata, as many legitimate applications do too.
Security software still plays an important role. It can block known malicious websites, detect malware after it’s identified, and stop many malicious downloads or redirects before they complete.
But recognizing that a “movie” ending in .exe is never really a movie remains one of the simplest and most effective security checks users can make themselves.
What to do if you may have been affected
If you clicked Fix It Now and something unexpected downloaded or opened afterward, run a full Malwarebytes scan.
If you ran a supposed movie that turned out to be an .exe, disconnect the computer from the network, perform a full malware scan, and avoid using the device for banking, email, or other sensitive accounts until you’re confident it’s clean.
Check your browser for extensions you don’t remember installing and remove anything unfamiliar.
If you executed an unknown program, change passwords for important accounts from a separate, trusted device.
Treat any pirated “movie” that isn’t a standard video format as suspicious. There is no legitimate reason for a movie download to be a Windows application.
Closing thoughts
Piracy-adjacent malvertising and fake-movie droppers persist because they don’t need to be sophisticated. They only need a title popular enough to guarantee search traffic. A $250 million IMAX epic with a year of ticket pre-sales behind it is about as close to guaranteed traffic as the piracy economy gets, which is why these scams surfaced within hours of release day rather than weeks later.
If you’re downloading a film and it asks you to install something, fix your browser, or run an .exe, you’re almost certainly not getting a movie. You’re downloading software that could infect your computer.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
Apple is urging users to treat any suspicious FaceTime call or message as untrusted, especially if it involves payments, refunds, password resets, or requests for personal information.
This warning appears in a broader Apple support article about scams that target iPhone and iPad users through social engineering. Apple says attackers may contact people by phone calls, FaceTime, text messages, or emails while pretending to represent a trusted organization.
The advice comes as many users still delay installing security updates, leaving them exposed even after Apple has released security patches.
Over recent months, we’ve seen a familiar pattern: attackers combine convincing Apple‑branded social engineering with known iOS vulnerabilities, then profit from the gap between “patch available” and “patch installed.”
Criminals have been reported making unsolicited FaceTime calls that look like they come from “Apple Support” or a bank, alongside messages disguised as urgent account alerts or refund offers. Once the victim answers or replies, the script is pretty much standard:
The caller claims there is fraudulent activity or a technical problem.
They pressure the user to “verify” card details, online banking credentials, or Apple ID information.
In some cases, they persuade the victim to install remote‑access software or share one‑time passcodes.
Nothing in this process requires malware on the device. The “exploit” is human trust, backed by familiar names, logos, and a real‑time call that feels inherently more legitimate than a text message. That makes FaceTime a useful delivery channel for social engineering, especially since users are used to seeing Apple notifications and support prompts elsewhere in their digital life.
From an attacker’s point of view, combining social engineering with vulnerabilities is attractive. Social engineering can steal your usernames and passwords, while a browser‑side exploit can silently execute malicious code when users visit a booby‑trapped site. Chain those attacks together and the attacker can move from app‑level compromise to full system control. That’s how campaigns like DarkSword operate.
How to stay safe
Apple’s advice is straightforward:
Don’t trust unexpected calls or texts.
Never share sensitive information over unsolicited contact.
Keep your iPhone updated to the latest iOS version.
Be especially suspicious of unexpected FaceTime calls claiming to be from your bank or Apple. These organizations are unlikely to use FaceTime to contact you about serious account issues.
Apple also asks users to report suspicious FaceTime calls:
“If you receive a suspicious FaceTime call (for example, from what looks like a bank or financial institution), email a screenshot of the call information to reportfacetimefraud@apple.com.”
How to update your iPhone or iPad
To check whether you’re running the latest version of iOS or iPadOS:
Go to Settings > General > Software Update. If an update is available, you’ll be able to download and install it from there.
Turn on Automatic Updates if you haven’t already. You’ll find it on the same screen. That way, your device can install important security updates as soon as they’re available.
Scammers know more about you than you think.
Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in.
You want to turn some crypto into a gift card. You search, click a promising result, and land on a site that looks polished and legitimate: a dark theme, trust badges, and promises of instant delivery and no ID checks. You wouldn’t think to question it.
But a professional-looking website isn’t proof that it’s legitimate.
What’s going on
Crypto gift card sites are an easy category to fake.
Several legitimate platforms let people convert Bitcoin, Ethereum, and other cryptocurrencies into gift cards for major brands. They also tend to look similar: a dark theme, a bold “Pay with crypto” message, trust badges, and a grid of popular gift card deals.
That makes them easy to imitate.
Scammers build lookalike sites that copy the same design language and sometimes even use a name that’s only one or two letters different from a legitimate platform. They’re designed to be mistaken for the real thing by anyone scrolling quickly or clicking through from an ad or search result.
The pricing is part of the deception, too. A $100 Amazon gift card for $95. A $25 Steam Wallet code for $24. A $100 Netflix gift card for $92. Those discounts don’t look unrealistic, so the scam looks very convincing.
What’s the scam?
The simplest scam is non-delivery. You pay, and nothing arrives because there was never any gift card to send. The website exists solely to collect crypto payments.
Crypto payments generally can’t be reversed. There’s no bank to call and no chargeback if the gift card never arrives. Once your Bitcoin or Ethereum leaves your wallet, it’s usually gone. Some scams go a step further and send you a code. It just isn’t a legitimate one.
Stolen gift card numbers are bought and sold on cybercriminal marketplaces, often for a fraction of their face value because they’re likely to be drained or reported before they’re redeemed. A scam site can buy those codes cheaply, resell them at what looks like a reasonable discount, and leave you with a code that never works or stops working shortly after purchase.
Even if a stolen code works at first, buying it helps create demand for more stolen gift cards.
There’s another reason these sites attract criminals. Crypto gift cards are commonly used to launder stolen cryptocurrency. Converting crypto into gift cards, and gift cards into goods or account balances, makes transactions harder to trace. A fake storefront doesn’t just be steal from buyers, organized crime gangs also use it to move funds.
None of this requires advanced technical skills. A convincing storefront, irreversible crypto payments, and search or social media ads are often enough to lure victims.
How to protect yourself
Go directly to the platform’s official site by typing the address yourself, rather than clicking a link from an ad, a search result, or a message.
Check the spelling of the domain character by character. Scam sites often use domains that differ from a legitimate one by just one or two letters.
Don’t assume “No ID required” means a site is trustworthy. It’s a genuine feature on some platforms, but scammers use it too.
Think twice before clicking Connect Wallet. Depending on the permissions you approve, it can expose more than a single payment.
Be skeptical of discounted gift cards, even modest discounts. Small discounts are designed to look believable.
Search for the platform’s name plus “scam” or “reviews” before you pay, especially if you found the site through an ad.
Use a browser extension that blocks scam and phishing sites, such as Malwarebytes Browser Guard. It can flag a fake storefront before you land on it, even ones it hasn’t seen before.
If you’ve already sent crypto to a suspicious site
Treat the funds as unrecoverable, but act quickly anyway.
If you have the transaction ID, check a blockchain explorer to see whether the funds were sent to a known exchange. If they were, contact the exchange’s fraud team immediately.
If you connected your wallet rather than sending a payment, review and revoke any token approvals you granted.
Mule betting or third-party betting account scams are a form of money mule scam where criminals recruit or coerce people into opening gambling accounts in their own name. The criminals then use those accounts to place bets to help launder money and obscure the source or ownership of funds.
The UK Gambling Commission describes “mule” betting accounts as online betting accounts created using another person’s personal details, with or without that person’s knowledge. It says criminals can control large numbers of these accounts to disguise who is betting and where the money came from. The Commission also warns that criminals may move illicit funds through third-party bank accounts to break the audit trail, often targeting vulnerable people and university students.
A common pattern is that the scammer offers easy money, “helps” the victim open an account, or claims they can’t use their own identity. That matches broader money mule recruitment tactics, where criminals approach people online, promise quick cash, and use the victim’s account to move or launder funds.
“A money mule is someone who lets criminals use their bank account to move money. Often the mule doesn’t know what’s really happening, and has been manipulated into believing a cover story, or lured by an offer of payment.”
A UK study published in 2025 found that 21% of adults had been asked to receive money into their bank account, apply for a loan on someone else’s behalf, or open a new account—all in exchange for cash.
Mule betting is a specialized form of money mule scam. As well as helping to hide the source and destination of criminal funds, these accounts can also end up being involved in betting-related crime, including match fixing.
It is important to realize that by acting as a money mule, you’re getting involved with organized crime. In the US, money mules can face criminal prosecution, and authorities warn that claiming “you didn’t know” is not always a defense.
The FBI says common targets include students, job seekers, and people using dating sites. The “mule herder” usually promises easy money, then quickly asks the victim to open a bank or betting account or receive and transfer money on their behalf. Money gets deposited into that account from a fraud victim, a stolen source, or another mule who is a link in the chain.
The criminal then uses the account to place bets, move funds, or cash out in ways that make the money appear to be gambling winnings rather than the proceeds of fraud.
The key gain for the criminals is layering: each extra account, bet, transfer, or cash-out step makes the money harder to trace. On paper, the account holder appears to be the person carrying out the transactions, even though someone else is controlling the account.
From the victim’s perspective, it can look like a legit side hustle at first: easy money, simple tasks, and a promise they can keep a percentage. After that, the requests usually escalate into more frequent transfers, identity verification, sending card details, or handing over full control of the account.
How to stay safe
Like many scams, money mule schemes often start with small, seemingly harmless requests before escalating. The safest approach is simple: if someone asks you to move money in exchange for an easy reward, assume it’s a scam unless you can independently prove otherwise.
Never use your own bank account to move money for someone else. Legitimate employers or businesses do not ask you to receive and forward funds through your personal account. This is a common follow-up tactic in romance, friendship, and job scams.
Be skeptical of easy-money offers, especially “work-from-home” jobs that promise quick pay for simple transfers. If it sounds too good to be true, it usually is.
Research any company or person making the offer before you respond. Check that the business is real, registered, and traceable, and be extra cautious with overseas or hard-to-verify contacts.
Never share banking details, passwords, PINs, or one-time passcodes with anyone you do not fully trust. Protecting access to your accounts helps block both coercion and takeover attempts.
Monitor your accounts regularly and act fast on unexpected deposits or suspicious requests. If money appears out of nowhere, do not touch it; contact your bank immediately.
Pro tip: If someone contacts you out of the blue, Malwarebytes Scam Guard can help you determine whether it’s a scam.
Something feel off? Check it before you click.
Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.
Crypto prediction and betting sites are appearing around the World Cup, and researchers have already tracked scams aimed at fans, including fake ticketing, fixed-match betting, prediction scams, and fan-branded meme coins.
We investigated one prediction site ourselves. While we aren’t claiming every site works the same way, it matched several well-known scam patterns. Whether it’s a worthless token, a fake betting platform, or a disappearing website, the result is often the same: you lose money.
What you need to know
This isn’t a single scam. Different sites use different tactics, but many follow the same playbooks.
Even if a site pays out exactly what it promises, you could receive a token that’s difficult or impossible to sell.
Some sites simply keep your deposit and stop responding.
Crypto transactions generally can’t be reversed. Once you’ve sent the money, recovering it may be impossible.
A World Cup-themed crypto prediction site
How you lose money
The last three examples below are based on a token we investigated directly. The first two are common scam patterns seen across this category.
Pump-and-dump: A token is promoted through the game, early participants receive genuine payouts that build trust, then the creators sell their holdings and the price collapses. Later buyers are left with a token few people want.
Take the money and vanish: You deposit crypto to unlock betting or enter the game. The site keeps the money and disappears.
Fake free-to-play: The game is advertised as free, but you have to buy or hold a token before you can participate. The game attracts users; the token sale generates revenue.
Copycat naming: A new token uses a name similar to an established cryptocurrency, making it easier for people to mistake it for a legitimate project.
Manufactured activity: The same tokens move repeatedly through a central wallet, creating the appearance of trading activity. On charts, it can look like an active market when little genuine trading is taking place.
Traditional crypto advice doesn’t help much here
You’ve probably heard advice like “never share your seed phrase.” That’s still important, but it isn’t what’s happening here.
These sites don’t need access to your wallet or seed phrase. They persuade you to send money voluntarily. Once you’ve done that, there may be nothing to recover.
How to check a token
Look at how many people actually hold the token. A token with very few holders, despite lots of apparent trading, deserves extra scrutiny.
Just four holders, which is a major red flag for a supposedly active token
Check the transfer history, not just the trading volume. On one token we examined, identical amounts repeatedly moved into and back out of the same central wallet. We confirmed this pattern across more than a dozen addresses. Genuine market activity rarely produces repeated matching round trips like this.
Repeated transfers create the appearance of trading
Search the token name alongside “price.” If a similarly named cryptocurrency already exists, you may be looking at a copycat.
A copycat token on Pump.fun
Before sending money, ask yourself what happens if you never see it again. If you aren’t comfortable with that answer, don’t send it.
If you’ve already sent money
Don’t send more to unlock a refund or payout. That’s often part of the scam.
Assume the money may be gone. Waiting for the site to make things right rarely works.
Disconnect unfamiliar apps, then revoke any spending permissions you granted. Disconnecting a wallet from a site doesn’t necessarily revoke any spending approvals you’ve already granted. Check your wallet’s support pages for instructions on reviewing and revoking those permissions.
Report the scam to help protect others:
Report the website to your country’s cybercrime reporting service or consumer protection agency.
Report the wallet address if the wallet or exchange you use provides an abuse reporting option.
If you found the site through social media or a search engine, report the post or advert so it can be reviewed.
Whether the site pays you in a token that quickly becomes worthless or simply disappears with your deposit, the outcome can be much the same.
If a crypto prediction game asks you to buy or hold a token before you can play, stop and ask why. The game may be there to encourage token sales rather than reward successful predictions.
Stop threats before they can do any harm.
Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →
Not sure this will have any effect, but I support the effort:
According to Google’s legal filing, Outsider Enterprise operates through Telegram. The group offers phishing-as-a-service to individuals who may not be technically savvy enough to set up fraudulent websites and text campaigns on their own. In its Telegram channels, Outsider Enterprise reportedly provided instructions on how to use Google’s Gemini AI to create websites that imitate those of Google, YouTube, and government agencies such as New York’s E-ZPass. The group offered nearly 300 scam templates.
[…]
Google worked with AT&T, Verizon, and T-Mobile to block many of these malicious text messages, and Google notes that its on-device scam detection in Google Messages probably helped reduce the number of successful phishing attempts, too. This AI-powered feature apparently stops 10 billion scam texts every month, so it’s fair to expect it caught at least some Outsider Enterprise activity.
Like any other marketplace, the social commerce platform has its share of red flags. It pays to know what to look for so you can shop or sell without headaches.
Login
