Parcel delivery phishing campaigns appear around the world under different courier names. In the United States, the messages commonly impersonate USPS and claim that a package has an invalid address or could not be delivered. Similar messages impersonate Colissimo and Chronopost in France, Correos in Spain, Poste Italiane in Italy, and PostNL in the Netherlands.

The details vary, but the aim is usually the same: to persuade you to visit a fake courier website and provide personal and financial information.

A fake bpost delivery email

A recent campaign targeting customers of the Belgian postal service bpost begins with an email claiming that a package could not be delivered because €4.95 in customs duties has not been paid.

In English, the subject and message read:

Undelivered package—customs duties due (tracking no. 3232116291*******).

Your package could not be delivered on September 9, 2026, because the customs duties (€4.95) have not been paid.

The amount is small enough that recipients may pay without giving it much thought. However, the website does not stop at collecting the supposed fee. It asks for personal information, card details, and banking information.

How the scam works 

The link first passes through a URL-shortening service (hxxps://qr[.]paps[.]jp/1GWsa) before redirecting to a fake bpost site. The campaign used several fake bpost domains, including:

hxxps://bpost[.]be-pakje-ontvangen-nl-recevoir-colis-fr[.]my[.]id/

bpost[.]center, which is the domain shown in the screenshots below.

The page copies bpost’s branding and displays security claims such as “Secure SSL connection,” “256-bit SSL,” “SEPA compliant,” and “Secure payment.” These labels were added by the scammers and do not prove that the page or payment is secure.

We’ve translated the screenshots below from the original Dutch into English.

The first page asks for the recipient’s name, phone number, email address, and age:

That reference to receiving funds does not match the email’s claim that a customs fee must be paid. The next page asks for an IBAN, card number, expiry date, and payment amount:

Then it asks for the real target: full card and bank details. 

The original Dutch version contained another mistake: One of its buttons read “Indian search” instead of “Betaal,” the Dutch word for “Pay.” Mistakes like this can expose a scam, but many phishing pages are built carefully enough that there will be no obvious typo or mistranslation.

Once submitted, card details may be used for fraudulent purchases or sold to other criminals. The personal and banking information may also be used to make later scams more convincing.

How to protect yourself 

• Check delivery claims independently. Open the courier’s official app or type its website address into your browser, then use your tracking number to check the delivery.
• Check the sender and destination. A message may use a courier’s name while coming from an unrelated email address or linking to a different domain.
• Be wary of unexpected fees or refunds. A small payment or promised refund can be used to persuade you to provide much more valuable information.
• Be wary of requests for extensive financial information. A request for an IBAN as well as card details should be treated with suspicion, particularly when it supposedly relates to a small delivery fee.

If you entered your card or banking information on a suspicious site, contact your bank or card provider immediately. Freeze the affected card if your banking app allows it, monitor your accounts for unfamiliar transactions, and change any password you entered on the site.

Malwarebytes tracks and blocks these campaigns as they appear. If you’re unsure about a message, Scam Guard—built into Malwarebytes for Windows, Mac, Android, and iOS—can check it for you. Paste in the message or link, or upload a screenshot, for an instant assessment.

---

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Parcel delivery phishing campaigns appear around the world under different courier names. In the United States, the messages commonly impersonate USPS and claim that a package has an invalid address or could not be delivered. Similar messages impersonate Colissimo and Chronopost in France, Correos in Spain, Poste Italiane in Italy, and PostNL in the Netherlands.

The details vary, but the aim is usually the same: to persuade you to visit a fake courier website and provide personal and financial information.

A fake bpost delivery email

A recent campaign targeting customers of the Belgian postal service bpost begins with an email claiming that a package could not be delivered because €4.95 in customs duties has not been paid.

In English, the subject and message read:

Undelivered package—customs duties due (tracking no. 3232116291*******).

Your package could not be delivered on September 9, 2026, because the customs duties (€4.95) have not been paid.

The amount is small enough that recipients may pay without giving it much thought. However, the website does not stop at collecting the supposed fee. It asks for personal information, card details, and banking information.

How the scam works 

The link first passes through a URL-shortening service (hxxps://qr[.]paps[.]jp/1GWsa) before redirecting to a fake bpost site. The campaign used several fake bpost domains, including:

hxxps://bpost[.]be-pakje-ontvangen-nl-recevoir-colis-fr[.]my[.]id/

bpost[.]center, which is the domain shown in the screenshots below.

The page copies bpost’s branding and displays security claims such as “Secure SSL connection,” “256-bit SSL,” “SEPA compliant,” and “Secure payment.” These labels were added by the scammers and do not prove that the page or payment is secure.

We’ve translated the screenshots below from the original Dutch into English.

The first page asks for the recipient’s name, phone number, email address, and age:

That reference to receiving funds does not match the email’s claim that a customs fee must be paid. The next page asks for an IBAN, card number, expiry date, and payment amount:

Then it asks for the real target: full card and bank details. 

The original Dutch version contained another mistake: One of its buttons read “Indian search” instead of “Betaal,” the Dutch word for “Pay.” Mistakes like this can expose a scam, but many phishing pages are built carefully enough that there will be no obvious typo or mistranslation.

Once submitted, card details may be used for fraudulent purchases or sold to other criminals. The personal and banking information may also be used to make later scams more convincing.

How to protect yourself 

• Check delivery claims independently. Open the courier’s official app or type its website address into your browser, then use your tracking number to check the delivery.
• Check the sender and destination. A message may use a courier’s name while coming from an unrelated email address or linking to a different domain.
• Be wary of unexpected fees or refunds. A small payment or promised refund can be used to persuade you to provide much more valuable information.
• Be wary of requests for extensive financial information. A request for an IBAN as well as card details should be treated with suspicion, particularly when it supposedly relates to a small delivery fee.

If you entered your card or banking information on a suspicious site, contact your bank or card provider immediately. Freeze the affected card if your banking app allows it, monitor your accounts for unfamiliar transactions, and change any password you entered on the site.

Malwarebytes tracks and blocks these campaigns as they appear. If you’re unsure about a message, Scam Guard—built into Malwarebytes for Windows, Mac, Android, and iOS—can check it for you. Paste in the message or link, or upload a screenshot, for an instant assessment.

---

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Only days after Revolut acknowledged that it disclosed sensitive customer records to an unauthorized party, affected customers are receiving phishing texts. However, we don’t know yet if the phishing texts are linked to the breach.

The company had accepted fraudulent information requests sent from an email address on a legitimate government agency domain.

Through this social engineering attack, rather than by gaining access to Revolut’s systems, the criminals obtained the following types of information about customers:

• Identity and contact information such as dates of birth, postal addresses, email addresses, and phone numbers
• Copies of IDs such as passports and driver’s licenses
• Verification selfies
• Account statements and transaction histories

Revolut has said only that a “limited” or “very limited” number of customers were affected, and that it contacted them directly.

One affected customer received a phishing text on Monday, September 14, two days after Revolut publicly acknowledged the data breach. The message appeared in the same conversation as other Revolut texts, making it look as though it had come from the bank.

According to VirusTotal, the phishing domain was first scanned that same day.

In a separate example, another customer said that opening the link took them to a web page that requested access to their device’s camera. If you tap Allow, the page reportedly imitates Revolut’s live-video “turn your head” identity check before prompting you to enter a password.

This makes the phishing page appear more authentic. It may also allow the scammers to collect a selfie or video that could be used for further social engineering, identity fraud, or to make subsequent scams more convincing.

A convincing fake liveness check followed by a password screen is a common way to lower suspicion and obtain the information attackers need to attempt a real login or account-recovery flow.

If the campaign is connected to the breach, the information obtained from Revolut, combined with login details entered by victims or their approval of a login request, could be enough to take over their accounts.

How to stay safe

We don’t yet know whether the phishing campaign is using data exposed in the breach or whether unrelated scammers are exploiting news of the incident to target Revolut customers more broadly.

Either way, treat unexpected messages about your account with caution:

• Don’t follow links in unsolicited messages. If a message concerns your account, open the official Revolut app directly.
• Check the actual domain in your browser’s address bar to see if it corresponds with what you expect.
• Use an up-to-date, real-time anti-malware solution on your device, preferably with a web protection component.
• Malwarebytes Scam Guard can help you determine whether a message is a scam and advise you on what to do next.

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Only days after Revolut acknowledged that it disclosed sensitive customer records to an unauthorized party, affected customers are receiving phishing texts. However, we don’t know yet if the phishing texts are linked to the breach.

The company had accepted fraudulent information requests sent from an email address on a legitimate government agency domain.

Through this social engineering attack, rather than by gaining access to Revolut’s systems, the criminals obtained the following types of information about customers:

• Identity and contact information such as dates of birth, postal addresses, email addresses, and phone numbers
• Copies of IDs such as passports and driver’s licenses
• Verification selfies
• Account statements and transaction histories

Revolut has said only that a “limited” or “very limited” number of customers were affected, and that it contacted them directly.

One affected customer received a phishing text on Monday, September 14, two days after Revolut publicly acknowledged the data breach. The message appeared in the same conversation as other Revolut texts, making it look as though it had come from the bank.

According to VirusTotal, the phishing domain was first scanned that same day.

In a separate example, another customer said that opening the link took them to a web page that requested access to their device’s camera. If you tap Allow, the page reportedly imitates Revolut’s live-video “turn your head” identity check before prompting you to enter a password.

This makes the phishing page appear more authentic. It may also allow the scammers to collect a selfie or video that could be used for further social engineering, identity fraud, or to make subsequent scams more convincing.

A convincing fake liveness check followed by a password screen is a common way to lower suspicion and obtain the information attackers need to attempt a real login or account-recovery flow.

If the campaign is connected to the breach, the information obtained from Revolut, combined with login details entered by victims or their approval of a login request, could be enough to take over their accounts.

How to stay safe

We don’t yet know whether the phishing campaign is using data exposed in the breach or whether unrelated scammers are exploiting news of the incident to target Revolut customers more broadly.

Either way, treat unexpected messages about your account with caution:

• Don’t follow links in unsolicited messages. If a message concerns your account, open the official Revolut app directly.
• Check the actual domain in your browser’s address bar to see if it corresponds with what you expect.
• Use an up-to-date, real-time anti-malware solution on your device, preferably with a web protection component.
• Malwarebytes Scam Guard can help you determine whether a message is a scam and advise you on what to do next.

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Since early May 2026, we’ve been monitoring a large phishing campaign based on T-Mobile rewards points.

The messages falsely warn that a customer’s rewards points are about to expire. They aren’t legitimate account notices: They use urgency, invented point balances, and phishing links to push recipients into acting before they can verify the claim.

A typical message says that a T-Mobile Rewards account holds 18,400 points, gives an imminent expiry date, and states that unused points will be removed under the program’s terms. These details make the message look as though it was written specifically for the recipient, even though it was sent to many people.

“T-Mobile Rewards Points Reminder: Your Points Are About to Expire

Dear Customer,

We are hereby reminding you that your T-Mobile Rewards account points are about to expire. You currently have 18,400 points, which will expire on June 4, 2026, if unused.

Your Points Overview:

Current Balance: 18,400 Points

Expiry Date: {today or tomorrow}

Points will not be recovered after this date.

Redeem Points:

Visit:

https://t-mobile.{rotating domains}.top/pay

Use the T-Mobile App: Account > Rewards & Benefits

Our points expiry policy aims to ensure the fairness of the program and encourage active participation. Please don’t let these valuable points go to waste.

Thank you for choosing T-Mobile.

Customer Service Team”

This phishing operation does not rely on a single, identical SMS. We found more than 1,000 closely related campaign templates with a semantic similarity score of at least 0.60. The 199 closest matches all scored at least 0.95.

This means the variations only change superficial elements, such as the salutation, headline, expiry date, point balance, and whether the message is called a “reminder,” “alert,” or “important update.” The central story remains the same: T-Mobile rewards points are supposedly expiring, and the recipient must follow a link to redeem them as soon as possible.

The messages use formal but generic language, such as “Dear T-Mobile Customer,” “Dear Valued Customer,” or “T-Mobile User,” rather than naming the recipient or providing verifiable account information.

The campaign began slowly before producing two huge spikes in activity. The green line shows detections of message variants seen previously, while the red line shows messages detected on the first day that particular variant appeared. We’re still seeing messages from the campaign, although activity has fallen considerably since those spikes.

The scam relies on a familiar social engineering formula: a valuable-looking reward, a deadline, and a simple action that supposedly protects the customer from losing out. A recipient who has a T-Mobile account may click first and question the message later.

The links use rotating domains designed to look as though they belong to T-Mobile. Their purpose is to persuade recipients to follow the link to supposedly redeem their points. Do not enter login credentials, personal information, payment details, or verification codes after following a link in an unsolicited message.

How to stay safe

The anonymized data used in this analysis was gathered through Text Protection in Malwarebytes Mobile Security, which alerts users to potentially malicious or scam text messages. 

You can also reduce your risk by following these tips:

• Don’t follow links in unsolicited messages. Instead, open the alleged sender’s website or app independently and check for notifications there.
• Check the domain in your browser’s address bar to make sure it matches the site you expected to visit.
• Use an up-to-date, real-time anti-malware solution with web protection.
• Malwarebytes Scam Guard can help you determine whether a message is a scam and advise you on what to do next.

The URLs in this campaign are very short-lived. The criminals used at least 81 domains over four months, but the domains follow a recognizable pattern that is blocked in Malwarebytes Browser Guard.

IOCs

Example domains showing the pattern used by the campaign:

t-mobile.biktpw[.]top

t-mobile.cugbjl[.]top

t-mobile.cymfjd[.]top

t-mobile.gdikxv[.]top

t-mobile.hdzcnb[.]top

t-mobile.koxetp[.]top

t-mobile.nxdcfp[.]top

t-mobile.pkrbai[.]top

t-mobile.qfrhkt[.]top

t-mobile.qscizj[.]top

t-mobile.tmfncb[.]top

t-mobile.vmnqsu[.]top

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Since early May 2026, we’ve been monitoring a large phishing campaign based on T-Mobile rewards points.

The messages falsely warn that a customer’s rewards points are about to expire. They aren’t legitimate account notices: They use urgency, invented point balances, and phishing links to push recipients into acting before they can verify the claim.

A typical message says that a T-Mobile Rewards account holds 18,400 points, gives an imminent expiry date, and states that unused points will be removed under the program’s terms. These details make the message look as though it was written specifically for the recipient, even though it was sent to many people.

“T-Mobile Rewards Points Reminder: Your Points Are About to Expire

Dear Customer,

We are hereby reminding you that your T-Mobile Rewards account points are about to expire. You currently have 18,400 points, which will expire on June 4, 2026, if unused.

Your Points Overview:

Current Balance: 18,400 Points

Expiry Date: {today or tomorrow}

Points will not be recovered after this date.

Redeem Points:

Visit:

https://t-mobile.{rotating domains}.top/pay

Use the T-Mobile App: Account > Rewards & Benefits

Our points expiry policy aims to ensure the fairness of the program and encourage active participation. Please don’t let these valuable points go to waste.

Thank you for choosing T-Mobile.

Customer Service Team”

This phishing operation does not rely on a single, identical SMS. We found more than 1,000 closely related campaign templates with a semantic similarity score of at least 0.60. The 199 closest matches all scored at least 0.95.

This means the variations only change superficial elements, such as the salutation, headline, expiry date, point balance, and whether the message is called a “reminder,” “alert,” or “important update.” The central story remains the same: T-Mobile rewards points are supposedly expiring, and the recipient must follow a link to redeem them as soon as possible.

The messages use formal but generic language, such as “Dear T-Mobile Customer,” “Dear Valued Customer,” or “T-Mobile User,” rather than naming the recipient or providing verifiable account information.

The campaign began slowly before producing two huge spikes in activity. The green line shows detections of message variants seen previously, while the red line shows messages detected on the first day that particular variant appeared. We’re still seeing messages from the campaign, although activity has fallen considerably since those spikes.

The scam relies on a familiar social engineering formula: a valuable-looking reward, a deadline, and a simple action that supposedly protects the customer from losing out. A recipient who has a T-Mobile account may click first and question the message later.

The links use rotating domains designed to look as though they belong to T-Mobile. Their purpose is to persuade recipients to follow the link to supposedly redeem their points. Do not enter login credentials, personal information, payment details, or verification codes after following a link in an unsolicited message.

How to stay safe

The anonymized data used in this analysis was gathered through Text Protection in Malwarebytes Mobile Security, which alerts users to potentially malicious or scam text messages. 

You can also reduce your risk by following these tips:

• Don’t follow links in unsolicited messages. Instead, open the alleged sender’s website or app independently and check for notifications there.
• Check the domain in your browser’s address bar to make sure it matches the site you expected to visit.
• Use an up-to-date, real-time anti-malware solution with web protection.
• Malwarebytes Scam Guard can help you determine whether a message is a scam and advise you on what to do next.

The URLs in this campaign are very short-lived. The criminals used at least 81 domains over four months, but the domains follow a recognizable pattern that is blocked in Malwarebytes Browser Guard.

IOCs

Example domains showing the pattern used by the campaign:

t-mobile.biktpw[.]top

t-mobile.cugbjl[.]top

t-mobile.cymfjd[.]top

t-mobile.gdikxv[.]top

t-mobile.hdzcnb[.]top

t-mobile.koxetp[.]top

t-mobile.nxdcfp[.]top

t-mobile.pkrbai[.]top

t-mobile.qfrhkt[.]top

t-mobile.qscizj[.]top

t-mobile.tmfncb[.]top

t-mobile.vmnqsu[.]top

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Antivirus renewal scams often begin with a message claiming that your subscription has automatically renewed. When you follow the instructions to cancel it, you are taken to a fake page designed to collect your contact details. The renewal charge never existed.

Receiving a message that names the antivirus software you use does not necessarily mean the sender has access to your device or account. Scammers impersonate popular brands and send the same message to large numbers of people, knowing that some recipients will be customers.

As we’ve reported before, simply responding to a scam message can make your contact details more valuable because it confirms that your number is active and that you are willing to engage. Filling in this form gives scammers even more: your name, email address, phone number, and an indication that you may respond to a call about a supposed antivirus payment.

Those details can be sold to other scammers or used for the next stage of the scam: a phone call from someone who tries to persuade you to install remote access software or help them reverse a payment that never happened.

A closer look at a fake Avast site

During our scam-hunting activity, we saw one renewal scam site impersonating Avast, aimed at users in Belgium. It was noticeably more polished than most scam sites and contained several signs that it had been produced with the help of AI.

The page tells you that your Avast Premium Security subscription has renewed for €129.99, that it covers five devices, and that it will renew again the following February. There is a green tick, a status badge reading Active, and a tidy summary table laying out the amount, the payment method, and the dates.

None of it is real. There is no subscription and no charge, and the page has no connection to Avast, whose branding is being used without permission.

The page is written in French for a Belgian audience. The screenshots below have been machine-translated into English so the layout and wording are easier for you to follow.

Alongside the renewal summary is the part the scammers actually care about. A cancellation form asks for your full name, email address, and Belgian mobile number, but nothing else.

There is no password field or request for card details, which may be deliberate. A form asking only for a name, email address, and phone number can feel harmless and is far easier to fill in than a login page. A working mobile number attached to a real name is exactly what a scammer needs for the next stage: calling the victim and posing as support staff. The form is the lure, and the call is where the real danger begins.

The signs of AI involvement

The page was left with two notes in its code that were never meant for victims. Both were written in polite French and addressed to whoever had commissioned the work, explaining that the form did not yet send anything anywhere and that a real submission process would need to be connected later.

They read like a contractor handing over an unfinished job rather than a scammer leaving themselves a reminder, and that courteous, second-person summary of what still needs doing is very much how an AI assistant signs off.

Other clues are also consistent with AI-generated code. The code contained unused styling for a section that had been removed, suggesting that the page had been created in stages without a final review. The copy was grammatically correct but vague. It described the benefits of the subscription across four paragraphs without mentioning any specific Avast features, such as its firewall, VPN, or ransomware protection.

Taken together, these signs suggest that the page was built with the help of AI. Generated code carries no watermark, so that cannot be proven from the files alone.

The page was never finished

As the comments in the code explain, the form on this page sent nothing at all. Someone built a convincing fake, got the difficult parts right, and then stopped before connecting the piece that actually sends the data anywhere.

Other signs in the code suggest nobody had even opened the page in a browser to check it, since two pieces of text would have displayed as visible gibberish if they had. What we were looking at was most likely half-built, or possibly a template waiting to be sold on to someone who would add a destination for the stolen details.

Building a page like this used to take a certain amount of skill, which limited how many of them could be made. AI has lowered that barrier. Whoever made this could ask for a version in Dutch or German, or one aimed at an entirely different brand, and have it within minutes.

How to spot an antivirus renewal scam

The old advice was to look for mistakes: bad grammar, the wrong currency, a clumsy layout, or a stretched logo. That advice is less useful now because AI can produce fluent copy and polished layouts, while scammers can easily copy real logos. A page that looks professional is no longer evidence that it is genuine.

But the structure of the scam hasn’t changed. It still needs you to arrive somewhere unexpected, worry about losing money, and provide a way to contact you. Judge the situation rather than the appearance of the page.

• Check whether you were charged. If the message says a payment has already been taken, check your bank or card statement directly. If the payment is not there, there is nothing to cancel.
• Check the subscription through the official app or website. Don’t click the link in the message. Open the company’s app or website independently and sign in. Your account will show whether you have an active subscription and when your next payment is due.
• Be wary of a cancellation form that mainly wants your phone number. Legitimate cancellations usually happen inside your account, and a company you already pay knows how to reach you.
• Treat the follow-up call as the real danger. If you have filled in a form like this, you may receive a scam call next. You are under no obligation to answer or engage.
• Don’t install remote access software for someone who called you. It gives them control of your device and could put your accounts, passwords, and money at risk.

If you have already been on a call and installed something, disconnect the device from the internet, remove the software they asked you to install, and change your passwords from a different device. If you sent money or shared card details, contact your bank straight away.

Block and check suspected scams

The best protection is to stop scam pages before they open. Malwarebytes Browser Guard is a free extension for Chrome, Edge, Firefox, and Safari that blocks malicious websites, phishing attempts, and scam ads before they can do any harm.

Not sure whether something is a scam? Share a screenshot, message, phone number, or link with Scam Guard. It checks it in seconds and recommends what to do next. Scam Guard is built into Malwarebytes Premium Security for Windows, Mac, iOS, and Android.

If you received a call after filling in a form like this, enter the number into Malwarebytes Scam Number Check to see whether it has been linked to scam activity.

---

---

Antivirus renewal scams often begin with a message claiming that your subscription has automatically renewed. When you follow the instructions to cancel it, you are taken to a fake page designed to collect your contact details. The renewal charge never existed.

Receiving a message that names the antivirus software you use does not necessarily mean the sender has access to your device or account. Scammers impersonate popular brands and send the same message to large numbers of people, knowing that some recipients will be customers.

As we’ve reported before, simply responding to a scam message can make your contact details more valuable because it confirms that your number is active and that you are willing to engage. Filling in this form gives scammers even more: your name, email address, phone number, and an indication that you may respond to a call about a supposed antivirus payment.

Those details can be sold to other scammers or used for the next stage of the scam: a phone call from someone who tries to persuade you to install remote access software or help them reverse a payment that never happened.

A closer look at a fake Avast site

During our scam-hunting activity, we saw one renewal scam site impersonating Avast, aimed at users in Belgium. It was noticeably more polished than most scam sites and contained several signs that it had been produced with the help of AI.

The page tells you that your Avast Premium Security subscription has renewed for €129.99, that it covers five devices, and that it will renew again the following February. There is a green tick, a status badge reading Active, and a tidy summary table laying out the amount, the payment method, and the dates.

None of it is real. There is no subscription and no charge, and the page has no connection to Avast, whose branding is being used without permission.

The page is written in French for a Belgian audience. The screenshots below have been machine-translated into English so the layout and wording are easier for you to follow.

Alongside the renewal summary is the part the scammers actually care about. A cancellation form asks for your full name, email address, and Belgian mobile number, but nothing else.

There is no password field or request for card details, which may be deliberate. A form asking only for a name, email address, and phone number can feel harmless and is far easier to fill in than a login page. A working mobile number attached to a real name is exactly what a scammer needs for the next stage: calling the victim and posing as support staff. The form is the lure, and the call is where the real danger begins.

The signs of AI involvement

The page was left with two notes in its code that were never meant for victims. Both were written in polite French and addressed to whoever had commissioned the work, explaining that the form did not yet send anything anywhere and that a real submission process would need to be connected later.

They read like a contractor handing over an unfinished job rather than a scammer leaving themselves a reminder, and that courteous, second-person summary of what still needs doing is very much how an AI assistant signs off.

Other clues are also consistent with AI-generated code. The code contained unused styling for a section that had been removed, suggesting that the page had been created in stages without a final review. The copy was grammatically correct but vague. It described the benefits of the subscription across four paragraphs without mentioning any specific Avast features, such as its firewall, VPN, or ransomware protection.

Taken together, these signs suggest that the page was built with the help of AI. Generated code carries no watermark, so that cannot be proven from the files alone.

The page was never finished

As the comments in the code explain, the form on this page sent nothing at all. Someone built a convincing fake, got the difficult parts right, and then stopped before connecting the piece that actually sends the data anywhere.

Other signs in the code suggest nobody had even opened the page in a browser to check it, since two pieces of text would have displayed as visible gibberish if they had. What we were looking at was most likely half-built, or possibly a template waiting to be sold on to someone who would add a destination for the stolen details.

Building a page like this used to take a certain amount of skill, which limited how many of them could be made. AI has lowered that barrier. Whoever made this could ask for a version in Dutch or German, or one aimed at an entirely different brand, and have it within minutes.

How to spot an antivirus renewal scam

The old advice was to look for mistakes: bad grammar, the wrong currency, a clumsy layout, or a stretched logo. That advice is less useful now because AI can produce fluent copy and polished layouts, while scammers can easily copy real logos. A page that looks professional is no longer evidence that it is genuine.

But the structure of the scam hasn’t changed. It still needs you to arrive somewhere unexpected, worry about losing money, and provide a way to contact you. Judge the situation rather than the appearance of the page.

• Check whether you were charged. If the message says a payment has already been taken, check your bank or card statement directly. If the payment is not there, there is nothing to cancel.
• Check the subscription through the official app or website. Don’t click the link in the message. Open the company’s app or website independently and sign in. Your account will show whether you have an active subscription and when your next payment is due.
• Be wary of a cancellation form that mainly wants your phone number. Legitimate cancellations usually happen inside your account, and a company you already pay knows how to reach you.
• Treat the follow-up call as the real danger. If you have filled in a form like this, you may receive a scam call next. You are under no obligation to answer or engage.
• Don’t install remote access software for someone who called you. It gives them control of your device and could put your accounts, passwords, and money at risk.

If you have already been on a call and installed something, disconnect the device from the internet, remove the software they asked you to install, and change your passwords from a different device. If you sent money or shared card details, contact your bank straight away.

Block and check suspected scams

The best protection is to stop scam pages before they open. Malwarebytes Browser Guard is a free extension for Chrome, Edge, Firefox, and Safari that blocks malicious websites, phishing attempts, and scam ads before they can do any harm.

Not sure whether something is a scam? Share a screenshot, message, phone number, or link with Scam Guard. It checks it in seconds and recommends what to do next. Scam Guard is built into Malwarebytes Premium Security for Windows, Mac, iOS, and Android.

If you received a call after filling in a form like this, enter the number into Malwarebytes Scam Number Check to see whether it has been linked to scam activity.

---

---

Bitrefill is a legitimate company that sells gift cards for popular stores like Amazon, Deliveroo, Apple, Nintendo, and thousands of others. They also sell eSIMs, and mobile top-ups. You can pay on their website for all of these with cryptocurrency.

The scam is designed to catch people searching for Bitrefill or something it sells, like a gift card. Victims see a search result that appears to lead to Bitrefill but actually points to a lookalike domain. The fake site then takes them through what appears to be a normal purchase. The fake sites are not operated by or affiliated with Bitrefill; scammers have copied its branding and checkout process.

The victim chooses an amount and a cryptocurrency before receiving a QR code and payment address. But instead of paying Bitrefill, they send the cryptocurrency directly to an address controlled by the scammers. They receive nothing in return, and recovering the payment is extremely unlikely.

Why fake crypto checkouts work so well

Phishing typically involves several steps. First, an attacker has to steal a password. Then, they may have to get past two-factor authentication (2FA), log in to the account without tripping a fraud check, and find some way to turn account access into money. Plenty of scams fall apart somewhere in that chain.

This payment scam avoids those hurdles by persuading victims to send money directly to the scammers. There is no account to break into and no stolen card to use. The victim sends cryptocurrency straight to an address the scammers control, and cryptocurrency payments generally cannot be reversed or charged back.

The payment request also fits the situation. A demand for cryptocurrency might look suspicious on many websites, but Bitrefill genuinely accepts it. On a convincing copy of its checkout, paying with cryptocurrency appears completely normal.

All this may explain why we found a cluster of fake sites rather than a single page, with checkouts allowing payments of up to $1,990.

What the fake checkout looks like

The site we examined is a close copy of Bitrefill’s checkout, hosted on a domain built by bolting a word onto the brand name. Everything a customer would expect is present. The branding is right, the layout matches, the page is quick and polished, and the payment flow behaves exactly the way the real one does.

You’re asked for an email address for order updates, with links to terms of service and a privacy policy. You then choose how to pay, from a list offering Bitcoin, Ethereum, USDC, USDT, Solana, and Litecoin. The site also offers card payments for a small surcharge.

Next, you pick an amount, with preset buttons and a maximum of $1,990, although inconsistent currency symbols offer a small clue that something is wrong.

Finally, you reach a payment screen showing a QR code, an address marked for one-time use, the amount converted into your chosen cryptocurrency, and a countdown clock giving you just under an hour to send the funds.

None of those elements is a red flag on its own. Unique addresses, expiry timers, and currency conversion are all normal for crypto checkouts, which is exactly why the copy is convincing. Every pressure cue on the page is borrowed from legitimate payment systems.

The only meaningful difference is the address the money goes to, and by the time the victim sends the cryptocurrency, getting it back is extremely unlikely.

How people are reaching these pages

The distribution here does not appear to rely on email. Bitrefill has said publicly that sites copying its checkout and using similar names have been turning up in search engine results, and that its security team has been working with takedown specialists to have them removed.

The site’s configuration supports that. The fake checkout hands visitors back to a second domain in the same family, and the link it uses carries a parameter naming a search engine, suggesting the operators are tagging incoming traffic by where it came from.

There’s a detail here that deserves more attention than it usually gets. The fake checkout has commercial analytics software installed on it, the same kind of product a legitimate e-commerce team uses to measure how many visitors abandon a cart. Its presence suggests the operators want to measure and improve the number of visitors who complete a payment.

These campaigns are not opportunistic one-offs thrown together by someone hoping for a lucky hit. They’re run as businesses, measured and tuned like any other funnel, with the victim in the role of the customer.

A brand name is not a destination

The domains in this cluster use several tricks to make their addresses look convincing. Some swap one letter for a visually similar character, making the brand appear correct unless you look closely. Others add a plausible word such as pay or gift, producing addresses that resemble official payment sites. Some do both.

Several use internationalized domain names, which can contain characters from different alphabets or accented versions of Latin letters. Browsers translate these domains into an ASCII format beginning with xn--, known as Punycode. To the eye, the displayed versions can be almost indistinguishable from the genuine name.

The answer is not simply to become better at spotting tiny differences. These domains are designed to defeat visual inspection, and they can be especially difficult to recognize on a phone screen. Recognizing a company name somewhere in a web address does not tell you who owns it.

Remember, seeing the right company name in a URL is not enough. Check that the actual domain is exactly the one the company uses.

What to do

• Start at the website you already trust. Use a saved bookmark or carefully enter bitrefill.com yourself. If you are already making a purchase on the legitimate site, stay within that session instead of opening a checkout page from a separate search.
• Treat search results for payment and checkout pages with suspicion. Scammers can buy search ads or manipulate their sites into appearing prominently. The first result is not necessarily the safest one.
• Check the address bar before you send. Cryptocurrency payments generally cannot be reversed or charged back. Confirm that the main domain is exactly bitrefill.com before approving a payment.
• Be wary of domains containing a brand followed by an extra word. A legitimate subdomain would place the additional wording before the company’s main domain, as in pay.example.com. An address such as example-pay.com is a completely separate domain that anyone could register.
• Don’t approve wallet requests on a site you have not verified. Simply connecting a wallet does not normally transfer funds, but a fraudulent site may ask you to sign a transaction or grant token permissions that allow assets to be stolen.
• If you have already sent funds, act quickly, although recovery is unlikely. Report the destination address to the exchange or wallet provider you used, report the incident to your national fraud reporting service, and notify Bitrefill so it can add the domain to its takedown efforts. Recovery services that promise to retrieve stolen cryptocurrency for an upfront fee are often follow-up scams.

Check before you click

The simplest protection against a page like this is to avoid reaching it. Malwarebytes Browser Guard is a free browser extension that blocks known scam and phishing sites, along with malicious ads and search results that lead to them.

Got a screenshot or URL of a suspected scam? Upload it to Scam Guard—built into Malwarebytes Premium Security on Windows, Mac, iOS, and Android—and you’ll get a verdict and safety tips in seconds.

Indicators of compromise (IOCs)

Domains:

biterflll[.]com

bitigift[.]com

bitrefall[.]com

bitrefill-payments[.]com

bitrefill-pays[.]com

bitregift[.]com

bitregill[.]com

bitretill[.]com

bitrgift[.]com

bitrgifts[.]com

bitrnfill[.]com

bitruflli[.]com

butrefill[.]com

pay-bitregill[.]com

pay-bitrgift[.]com

pay-bitrgifts[.]com

pay-butrefill[.]com

pay-bitigift[.]com

xn--bitrefll-71a[.]com

xn--bitrefll-h2a[.]com

xn--bitrefll-pay-kfb[.]com

xn--bitrefll-pay-xfb[.]com

xn--bitrefll-q2a[.]com

xn--bitreill-cz9c[.]com

xn--bitreill-pay-yq4f[.]com

xn--btrefill-l2a[.]com

xn--pay-bitrefll-fgb[.]com

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Bitrefill is a legitimate company that sells gift cards for popular stores like Amazon, Deliveroo, Apple, Nintendo, and thousands of others. They also sell eSIMs, and mobile top-ups. You can pay on their website for all of these with cryptocurrency.

The scam is designed to catch people searching for Bitrefill or something it sells, like a gift card. Victims see a search result that appears to lead to Bitrefill but actually points to a lookalike domain. The fake site then takes them through what appears to be a normal purchase. The fake sites are not operated by or affiliated with Bitrefill; scammers have copied its branding and checkout process.

The victim chooses an amount and a cryptocurrency before receiving a QR code and payment address. But instead of paying Bitrefill, they send the cryptocurrency directly to an address controlled by the scammers. They receive nothing in return, and recovering the payment is extremely unlikely.

Why fake crypto checkouts work so well

Phishing typically involves several steps. First, an attacker has to steal a password. Then, they may have to get past two-factor authentication (2FA), log in to the account without tripping a fraud check, and find some way to turn account access into money. Plenty of scams fall apart somewhere in that chain.

This payment scam avoids those hurdles by persuading victims to send money directly to the scammers. There is no account to break into and no stolen card to use. The victim sends cryptocurrency straight to an address the scammers control, and cryptocurrency payments generally cannot be reversed or charged back.

The payment request also fits the situation. A demand for cryptocurrency might look suspicious on many websites, but Bitrefill genuinely accepts it. On a convincing copy of its checkout, paying with cryptocurrency appears completely normal.

All this may explain why we found a cluster of fake sites rather than a single page, with checkouts allowing payments of up to $1,990.

What the fake checkout looks like

The site we examined is a close copy of Bitrefill’s checkout, hosted on a domain built by bolting a word onto the brand name. Everything a customer would expect is present. The branding is right, the layout matches, the page is quick and polished, and the payment flow behaves exactly the way the real one does.

You’re asked for an email address for order updates, with links to terms of service and a privacy policy. You then choose how to pay, from a list offering Bitcoin, Ethereum, USDC, USDT, Solana, and Litecoin. The site also offers card payments for a small surcharge.

Next, you pick an amount, with preset buttons and a maximum of $1,990, although inconsistent currency symbols offer a small clue that something is wrong.

Finally, you reach a payment screen showing a QR code, an address marked for one-time use, the amount converted into your chosen cryptocurrency, and a countdown clock giving you just under an hour to send the funds.

None of those elements is a red flag on its own. Unique addresses, expiry timers, and currency conversion are all normal for crypto checkouts, which is exactly why the copy is convincing. Every pressure cue on the page is borrowed from legitimate payment systems.

The only meaningful difference is the address the money goes to, and by the time the victim sends the cryptocurrency, getting it back is extremely unlikely.

How people are reaching these pages

The distribution here does not appear to rely on email. Bitrefill has said publicly that sites copying its checkout and using similar names have been turning up in search engine results, and that its security team has been working with takedown specialists to have them removed.

The site’s configuration supports that. The fake checkout hands visitors back to a second domain in the same family, and the link it uses carries a parameter naming a search engine, suggesting the operators are tagging incoming traffic by where it came from.

There’s a detail here that deserves more attention than it usually gets. The fake checkout has commercial analytics software installed on it, the same kind of product a legitimate e-commerce team uses to measure how many visitors abandon a cart. Its presence suggests the operators want to measure and improve the number of visitors who complete a payment.

These campaigns are not opportunistic one-offs thrown together by someone hoping for a lucky hit. They’re run as businesses, measured and tuned like any other funnel, with the victim in the role of the customer.

A brand name is not a destination

The domains in this cluster use several tricks to make their addresses look convincing. Some swap one letter for a visually similar character, making the brand appear correct unless you look closely. Others add a plausible word such as pay or gift, producing addresses that resemble official payment sites. Some do both.

Several use internationalized domain names, which can contain characters from different alphabets or accented versions of Latin letters. Browsers translate these domains into an ASCII format beginning with xn--, known as Punycode. To the eye, the displayed versions can be almost indistinguishable from the genuine name.

The answer is not simply to become better at spotting tiny differences. These domains are designed to defeat visual inspection, and they can be especially difficult to recognize on a phone screen. Recognizing a company name somewhere in a web address does not tell you who owns it.

Remember, seeing the right company name in a URL is not enough. Check that the actual domain is exactly the one the company uses.

What to do

• Start at the website you already trust. Use a saved bookmark or carefully enter bitrefill.com yourself. If you are already making a purchase on the legitimate site, stay within that session instead of opening a checkout page from a separate search.
• Treat search results for payment and checkout pages with suspicion. Scammers can buy search ads or manipulate their sites into appearing prominently. The first result is not necessarily the safest one.
• Check the address bar before you send. Cryptocurrency payments generally cannot be reversed or charged back. Confirm that the main domain is exactly bitrefill.com before approving a payment.
• Be wary of domains containing a brand followed by an extra word. A legitimate subdomain would place the additional wording before the company’s main domain, as in pay.example.com. An address such as example-pay.com is a completely separate domain that anyone could register.
• Don’t approve wallet requests on a site you have not verified. Simply connecting a wallet does not normally transfer funds, but a fraudulent site may ask you to sign a transaction or grant token permissions that allow assets to be stolen.
• If you have already sent funds, act quickly, although recovery is unlikely. Report the destination address to the exchange or wallet provider you used, report the incident to your national fraud reporting service, and notify Bitrefill so it can add the domain to its takedown efforts. Recovery services that promise to retrieve stolen cryptocurrency for an upfront fee are often follow-up scams.

Check before you click

The simplest protection against a page like this is to avoid reaching it. Malwarebytes Browser Guard is a free browser extension that blocks known scam and phishing sites, along with malicious ads and search results that lead to them.

Got a screenshot or URL of a suspected scam? Upload it to Scam Guard—built into Malwarebytes Premium Security on Windows, Mac, iOS, and Android—and you’ll get a verdict and safety tips in seconds.

Indicators of compromise (IOCs)

Domains:

biterflll[.]com

bitigift[.]com

bitrefall[.]com

bitrefill-payments[.]com

bitrefill-pays[.]com

bitregift[.]com

bitregill[.]com

bitretill[.]com

bitrgift[.]com

bitrgifts[.]com

bitrnfill[.]com

bitruflli[.]com

butrefill[.]com

pay-bitregill[.]com

pay-bitrgift[.]com

pay-bitrgifts[.]com

pay-butrefill[.]com

pay-bitigift[.]com

xn--bitrefll-71a[.]com

xn--bitrefll-h2a[.]com

xn--bitrefll-pay-kfb[.]com

xn--bitrefll-pay-xfb[.]com

xn--bitrefll-q2a[.]com

xn--bitreill-cz9c[.]com

xn--bitreill-pay-yq4f[.]com

xn--btrefill-l2a[.]com

xn--pay-bitrefll-fgb[.]com

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Fortnite scam pages like the ones below appear by the dozen every day, recycled endlessly under different names and designs.

One version promises $50 from a fake superhero collaboration. Another claims it can calculate what your locker is worth. Both lead to the same destination: a fake Epic Games login page designed to steal your account. It’s an old trick, but it still catches people out.

The short version

If a website promises free V-Bucks, cash, or a tool to calculate your locker’s value, then asks you to log in with your Epic account to get it, it’s not run by Epic.

Epic doesn’t offer an official tool that values accounts, and no legitimate giveaway requires you to sign in through a third-party site. You’re just handing your Epic username and password to scammers.

If you or your child entered your Epic login details on one of these sites, assume the account has been compromised. Change the password immediately, turn on two-factor authentication, and don’t reuse that password on any other accounts.

Why do they want your login?

A stolen Fortnite account can be worth real money. Criminals can take over accounts with rare skins, spend any saved payment methods, sell the account on underground marketplaces, or use it to scam the owner’s friends. They may also try the same username and password on other online accounts, hoping the password has been reused.

Why Fortnite?

Fortnite still attracts around 110 million monthly players and has more than 650 million registered accounts. That alone makes it an attractive target for cybercriminals.

The audience’s age matters too. In December 2022, the US Federal Trade Commission (FTC) fined Epic Games a record $520 million, after alleging that the company knew children made up a substantial share of its player base and left voice and text chat turned on by default, exposing them to strangers. The Consumer Financial Protection Bureau (CFPB) also cites industry experts who say young gamers are especially vulnerable to phishing because they spend more time on social media and are less familiar with social engineering.

The game is also built around visible status. Skins, emotes, and pickaxes cost real money, making the idea that “your locker has a price” feel plausible. Rare or discontinued skins really do sell for hundreds of dollars on unofficial marketplaces, even though Epic offers no official way to cash out V-Bucks and selling accounts violates its terms of service. That kernel of truth is exactly what these locker-value scams exploit.

That’s also what makes them more convincing than a simple V-Bucks giveaway. Instead of promising something for nothing, they play on curiosity about something the player already owns. That’s probably why this version keeps coming back.

How the scam works

Some pages promise rewards:

Others skip the free-reward pitch and frame the locker itself as hidden value the player is owed:

Others frame it as competition instead of currency:

The hook changes, but the fake login page doesn’t. These sites all do the same thing. They ask you to sign in with your Epic account so they can steal your username and password.

Another variant: Fake settlement claims

This one borrows a real story. Epic did settle with the FTC for $520 million, and real payments are still going out in 2026. But the real settlement pays actual dollars through the FTC’s own process, not in-game V-Bucks through an “Epic Games Locker,” and the claim window closed in July 2025.

References to an “EU Regulatory Mandate” and the case number shown on these pages don’t match any genuine legal action.

How to stay safe

Fortnite scams change constantly, but the advice doesn’t.

• Use Malwarebytes Browser Guard to block known phishing sites before they have a chance to steal your login details.
• Only sign in to your Epic account at epicgames.com. If another website asks for your Epic login, leave.
• Be sceptical of offers that sound too good to be true. Free V-Bucks, locker valuations, and surprise rewards are all common phishing lures.
• Verify refunds and settlements on the official source. If a page claims you’re owed money, check the regulator’s website yourself instead of following its links.
• Turn on two-factor authentication (2FA). It can stop attackers from accessing your account even if they steal your password.
• Use Malwarebytes Scam Guard. It can help you identify suspicious links and messages before you click.

What to do if you clicked

• Change the Epic password immediately, going directly to epicgames.com, not through the suspicious link.
• Turn on two-factor authentication if you haven’t already.
• Check your linked email for password reset requests or login alerts you didn’t make.
• Review connected devices/services on the account and remove anything unfamiliar.
• If you entered payment details anywhere, contact your card issuer and monitor your statements.
• Report the page to Epic’s support and flag it as phishing in your browser.
• If the page claims to be part of a settlement or refund, verify it on the regulator’s official website. For the Epic settlement, that’s ftc.gov.

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Fortnite scam pages like the ones below appear by the dozen every day, recycled endlessly under different names and designs.

One version promises $50 from a fake superhero collaboration. Another claims it can calculate what your locker is worth. Both lead to the same destination: a fake Epic Games login page designed to steal your account. It’s an old trick, but it still catches people out.

The short version

If a website promises free V-Bucks, cash, or a tool to calculate your locker’s value, then asks you to log in with your Epic account to get it, it’s not run by Epic.

Epic doesn’t offer an official tool that values accounts, and no legitimate giveaway requires you to sign in through a third-party site. You’re just handing your Epic username and password to scammers.

If you or your child entered your Epic login details on one of these sites, assume the account has been compromised. Change the password immediately, turn on two-factor authentication, and don’t reuse that password on any other accounts.

Why do they want your login?

A stolen Fortnite account can be worth real money. Criminals can take over accounts with rare skins, spend any saved payment methods, sell the account on underground marketplaces, or use it to scam the owner’s friends. They may also try the same username and password on other online accounts, hoping the password has been reused.

Why Fortnite?

Fortnite still attracts around 110 million monthly players and has more than 650 million registered accounts. That alone makes it an attractive target for cybercriminals.

The audience’s age matters too. In December 2022, the US Federal Trade Commission (FTC) fined Epic Games a record $520 million, after alleging that the company knew children made up a substantial share of its player base and left voice and text chat turned on by default, exposing them to strangers. The Consumer Financial Protection Bureau (CFPB) also cites industry experts who say young gamers are especially vulnerable to phishing because they spend more time on social media and are less familiar with social engineering.

The game is also built around visible status. Skins, emotes, and pickaxes cost real money, making the idea that “your locker has a price” feel plausible. Rare or discontinued skins really do sell for hundreds of dollars on unofficial marketplaces, even though Epic offers no official way to cash out V-Bucks and selling accounts violates its terms of service. That kernel of truth is exactly what these locker-value scams exploit.

That’s also what makes them more convincing than a simple V-Bucks giveaway. Instead of promising something for nothing, they play on curiosity about something the player already owns. That’s probably why this version keeps coming back.

How the scam works

Some pages promise rewards:

Others skip the free-reward pitch and frame the locker itself as hidden value the player is owed:

Others frame it as competition instead of currency:

The hook changes, but the fake login page doesn’t. These sites all do the same thing. They ask you to sign in with your Epic account so they can steal your username and password.

Another variant: Fake settlement claims

This one borrows a real story. Epic did settle with the FTC for $520 million, and real payments are still going out in 2026. But the real settlement pays actual dollars through the FTC’s own process, not in-game V-Bucks through an “Epic Games Locker,” and the claim window closed in July 2025.

References to an “EU Regulatory Mandate” and the case number shown on these pages don’t match any genuine legal action.

How to stay safe

Fortnite scams change constantly, but the advice doesn’t.

• Use Malwarebytes Browser Guard to block known phishing sites before they have a chance to steal your login details.
• Only sign in to your Epic account at epicgames.com. If another website asks for your Epic login, leave.
• Be sceptical of offers that sound too good to be true. Free V-Bucks, locker valuations, and surprise rewards are all common phishing lures.
• Verify refunds and settlements on the official source. If a page claims you’re owed money, check the regulator’s website yourself instead of following its links.
• Turn on two-factor authentication (2FA). It can stop attackers from accessing your account even if they steal your password.
• Use Malwarebytes Scam Guard. It can help you identify suspicious links and messages before you click.

What to do if you clicked

• Change the Epic password immediately, going directly to epicgames.com, not through the suspicious link.
• Turn on two-factor authentication if you haven’t already.
• Check your linked email for password reset requests or login alerts you didn’t make.
• Review connected devices/services on the account and remove anything unfamiliar.
• If you entered payment details anywhere, contact your card issuer and monitor your statements.
• Report the page to Epic’s support and flag it as phishing in your browser.
• If the page claims to be part of a settlement or refund, verify it on the regulator’s official website. For the Epic settlement, that’s ftc.gov.

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Researchers have described a campaign that delivers a remote access Trojan (RAT) called AtlasRAT through a fake Flash Player installer.

People still go looking for “Flash player” because a surprising amount of content and software was built around Flash and never properly migrated. Users often just want a quick way to get those old sites, games, or business apps working again.

The underlying problem is that Adobe ended support for Flash Player on December 31, 2020, and actively blocks Flash content from running in the official player.

Attackers know some people will still search for Flash to run a game or a business app, so they wrap their malware in a fake Flash‑related installer that looks familiar and legitimate.

That’s likely why the AtlasRAT infection chain starts with a Delphi executable named FlashPlay.Exe, masquerading as an “AGE Flash Player” installer. The first-stage loader runs entirely in memory and reconstructs additional payloads instead of dropping obvious files to disk, a technique often referred to as fileless malware.

The final payload (MainDll.Dll) uses a self‑signed certificate spoofing CN=update.Microsoft.Com to initialize Transport Layer Security (TLS) client communication and encrypts Command and Control (C2) traffic.

A self‑signed certificate means the owner signs with their own key instead of a trusted certificate authority (CA). That means an attacker can create a certificate claiming to be update.microsoft.com or google.com, even though they don’t control those domains. A web browser would reject such a certificate with a warning. Custom malware, however, can simply ignore the operating system’s trust checks and use it to set up encrypted C2.

Once AtlasRAT is installed, the operator gains long‑term remote control of the infected Windows system with capabilities including:

• Collecting credentials via offline keylogging
• Gathering system information and identifying installed security products
• Exfiltrating data over encrypted channels
• Injecting DLLs into applications like WeChat, potentially allowing the attacker to monitor or manipulate messaging, or to hide malware activity or connectivity.

Based on historical data, the researchers suspect that AtlasRAT is a reusable framework or commercial offering rather than a one-off tool used by a single group.

How to stay safe

When looking for apps and software to perform a specific task, remember that cybercriminals often exploit popular searches in semi-targeted attacks. In previous campaigns, for example, AtlasRAT has also been distributed as a fake VPN installer.

Some tips to keep this RAT, and others, off your computer:

• Carefully check what you’re about to install. Sponsored search results are not a guarantee that software is legitimate.
• Use an up-to-date, real-time anti-malware solution to detect and block remote access Trojans. Malwarebytes detected AtlasRAT as Malware.AI.1710771908
• Keep your operating system, browser, and security software up to date.

---

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Researchers have described a campaign that delivers a remote access Trojan (RAT) called AtlasRAT through a fake Flash Player installer.

People still go looking for “Flash player” because a surprising amount of content and software was built around Flash and never properly migrated. Users often just want a quick way to get those old sites, games, or business apps working again.

The underlying problem is that Adobe ended support for Flash Player on December 31, 2020, and actively blocks Flash content from running in the official player.

Attackers know some people will still search for Flash to run a game or a business app, so they wrap their malware in a fake Flash‑related installer that looks familiar and legitimate.

That’s likely why the AtlasRAT infection chain starts with a Delphi executable named FlashPlay.Exe, masquerading as an “AGE Flash Player” installer. The first-stage loader runs entirely in memory and reconstructs additional payloads instead of dropping obvious files to disk, a technique often referred to as fileless malware.

The final payload (MainDll.Dll) uses a self‑signed certificate spoofing CN=update.Microsoft.Com to initialize Transport Layer Security (TLS) client communication and encrypts Command and Control (C2) traffic.

A self‑signed certificate means the owner signs with their own key instead of a trusted certificate authority (CA). That means an attacker can create a certificate claiming to be update.microsoft.com or google.com, even though they don’t control those domains. A web browser would reject such a certificate with a warning. Custom malware, however, can simply ignore the operating system’s trust checks and use it to set up encrypted C2.

Once AtlasRAT is installed, the operator gains long‑term remote control of the infected Windows system with capabilities including:

• Collecting credentials via offline keylogging
• Gathering system information and identifying installed security products
• Exfiltrating data over encrypted channels
• Injecting DLLs into applications like WeChat, potentially allowing the attacker to monitor or manipulate messaging, or to hide malware activity or connectivity.

Based on historical data, the researchers suspect that AtlasRAT is a reusable framework or commercial offering rather than a one-off tool used by a single group.

How to stay safe

When looking for apps and software to perform a specific task, remember that cybercriminals often exploit popular searches in semi-targeted attacks. In previous campaigns, for example, AtlasRAT has also been distributed as a fake VPN installer.

Some tips to keep this RAT, and others, off your computer:

• Carefully check what you’re about to install. Sponsored search results are not a guarantee that software is legitimate.
• Use an up-to-date, real-time anti-malware solution to detect and block remote access Trojans. Malwarebytes detected AtlasRAT as Malware.AI.1710771908
• Keep your operating system, browser, and security software up to date.

---

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

A whole industry has sprung up around selling TikTok “growth.”

Cheap views by the hundred, pre-made ad accounts, and polished sales pages promising a repeatable path to serious revenue.

None of it is officially sanctioned by TikTok, and depending on what you’re buying, you could end up wasting money, losing your account, or handing your login details to scammers.

Scam 1: Sites selling cheap likes and engagement

Sites selling bulk engagement all look remarkably similar.

They offer small bundles of views, likes, or followers for a few pounds, usually alongside identical packages for YouTube, Instagram, and other platforms.

The sales pitch is almost always the same: “100% real profiles,” “no bots, no click farms,” and “completely safe.”

Those claims are worth reading carefully because they’re addressing the biggest concern buyers already have.

At this price point, bulk engagement is usually generated through bots, click farms, or other artificial means—the very thing these sites insist they don’t use.

Even if your engagement numbers increase initially, TikTok’s fraud detection systems can remove artificial engagement, and accounts that repeatedly use these services risk being flagged or restricted.

Scam 2: The “aged” ad account marketplace

Another common offer is bulk TikTok Ads accounts sold as “aged” or “trusted,” often bundled with a replacement guarantee if an account stops working. The pitch is that you skip the hassle of setting up and verifying a new advertising account.

The problem is that you don’t know how those accounts were created. Many are built using stolen or synthetic identities, compromised payment details, or other deceptive methods. Buying one means inheriting that history—and the very real risk that TikTok detects it and suspends the account, along with any campaigns or ad budget attached to it. A replacement guarantee won’t help if your advertising is suddenly brought to a halt.

Scam 3: The growth framework

A third type of offer is less obviously a scam and more of a marketing funnel.

Slick landing pages—often hosted on free platforms and paired with an embedded video—promise a “proven blueprint” for turning TikTok into a major source of income, usually backed by impressive but unverifiable claims about past clients.

The immediate goal is usually to collect your email address, and sometimes your phone number, before revealing what’s actually for sale. That might be a paid course, a “done-for-you” management service, or a request for direct access to your TikTok Shop or Ads account.

What happens next varies, but the common thread is the same: you’re being asked to trust an unverified third party with your business, your money, or your account.

What you’re really signing up for

Not every TikTok marketing service is a scam. But if someone’s offering thousands of views for a few pounds, bulk “aged” ad accounts, or guaranteed growth, you’re in a very different part of the market.

These services promise shortcuts. What they often deliver is fake engagement, accounts with questionable histories, or requests for access to your own account.

At best, you’ve wasted your money on engagement TikTok later strips away. At worst, you’re buying an account built on stolen information or giving an untrusted third party full access to your own.

Our advice

• Don’t pay for views, likes, or followers. Artificial engagement isn’t real growth and can put your account at risk under TikTok’s rules.
• Never share your TikTok username and password with a “boosting” service, regardless of how it’s presented.
• Don’t buy or sell TikTok Ads or Business accounts outside TikTok’s own account creation process.
• Treat “guaranteed revenue” frameworks and courses like any other business opportunity: they’re sales pages first, educational content second.

None of this is unique to TikTok. The platform’s explosive growth has simply given a familiar ecosystem of low-effort scams a new audience.

---

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

A whole industry has sprung up around selling TikTok “growth.”

Cheap views by the hundred, pre-made ad accounts, and polished sales pages promising a repeatable path to serious revenue.

None of it is officially sanctioned by TikTok, and depending on what you’re buying, you could end up wasting money, losing your account, or handing your login details to scammers.

Scam 1: Sites selling cheap likes and engagement

Sites selling bulk engagement all look remarkably similar.

They offer small bundles of views, likes, or followers for a few pounds, usually alongside identical packages for YouTube, Instagram, and other platforms.

The sales pitch is almost always the same: “100% real profiles,” “no bots, no click farms,” and “completely safe.”

Those claims are worth reading carefully because they’re addressing the biggest concern buyers already have.

At this price point, bulk engagement is usually generated through bots, click farms, or other artificial means—the very thing these sites insist they don’t use.

Even if your engagement numbers increase initially, TikTok’s fraud detection systems can remove artificial engagement, and accounts that repeatedly use these services risk being flagged or restricted.

Scam 2: The “aged” ad account marketplace

Another common offer is bulk TikTok Ads accounts sold as “aged” or “trusted,” often bundled with a replacement guarantee if an account stops working. The pitch is that you skip the hassle of setting up and verifying a new advertising account.

The problem is that you don’t know how those accounts were created. Many are built using stolen or synthetic identities, compromised payment details, or other deceptive methods. Buying one means inheriting that history—and the very real risk that TikTok detects it and suspends the account, along with any campaigns or ad budget attached to it. A replacement guarantee won’t help if your advertising is suddenly brought to a halt.

Scam 3: The growth framework

A third type of offer is less obviously a scam and more of a marketing funnel.

Slick landing pages—often hosted on free platforms and paired with an embedded video—promise a “proven blueprint” for turning TikTok into a major source of income, usually backed by impressive but unverifiable claims about past clients.

The immediate goal is usually to collect your email address, and sometimes your phone number, before revealing what’s actually for sale. That might be a paid course, a “done-for-you” management service, or a request for direct access to your TikTok Shop or Ads account.

What happens next varies, but the common thread is the same: you’re being asked to trust an unverified third party with your business, your money, or your account.

What you’re really signing up for

Not every TikTok marketing service is a scam. But if someone’s offering thousands of views for a few pounds, bulk “aged” ad accounts, or guaranteed growth, you’re in a very different part of the market.

These services promise shortcuts. What they often deliver is fake engagement, accounts with questionable histories, or requests for access to your own account.

At best, you’ve wasted your money on engagement TikTok later strips away. At worst, you’re buying an account built on stolen information or giving an untrusted third party full access to your own.

Our advice

• Don’t pay for views, likes, or followers. Artificial engagement isn’t real growth and can put your account at risk under TikTok’s rules.
• Never share your TikTok username and password with a “boosting” service, regardless of how it’s presented.
• Don’t buy or sell TikTok Ads or Business accounts outside TikTok’s own account creation process.
• Treat “guaranteed revenue” frameworks and courses like any other business opportunity: they’re sales pages first, educational content second.

None of this is unique to TikTok. The platform’s explosive growth has simply given a familiar ecosystem of low-effort scams a new audience.

---

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Shoppers browsing on their phones are landing on convincing Walmart lookalike sites offering name-brand liquor at 40% to 70% off, only to be led straight to a checkout page asking for a full credit card number, expiry date, and CVV.

The sites have no connection to Walmart. They’re part of a network of more than 120 near-identical domains built to look like a legitimate retailer just long enough to steal your card details.

Fake Walmart websites

The name “Walmart” is doing most of the work here. It’s one of the most recognized retailers in the world, and it’s that familiarity that makes people lower their guard. A shopper who’d hesitate on an unfamiliar website may think nothing of an unusually large discount because the logo, colours, and layout look familiar.

That trust hasn’t been earned by the site. It’s borrowed from a brand that has nothing to do with it.

If you’ve entered your card details on one of these pages, the safest assumption is that your card has been compromised.

How the scam works

The scam follows a simple pattern: a Walmart-branded homepage, category pages stacked with heavily discounted liquor, and a checkout form asking for full card details.

The discounts do much of the persuading. Seeing premium brands advertised at 60% or 70% off encourages people to buy first and ask questions later.

The same WordPress/WooCommerce template powers every site in the network. They share the same product catalogue, prices, and images. The only differences are fabricated US business addresses and phone numbers that are swapped out for each domain.

How to avoid this scam

• Be sceptical of discounts that don’t match a retailer’s usual promotions, especially on liquor or electronics.
• Check the address bar before entering payment details. A genuine Walmart sale won’t send you to an unfamiliar .shop domain.
• Use tools that can identify scam websites automatically, such as Malwarebytes Browser Guard on desktop, or ask Scam Guard if it thinks a domain is suspicious.
• On mobile, where these sites are designed to work, Malwarebytes Mobile Security can block known phishing and scam domains before you reach the checkout.

If you already entered your card details

• Contact your card issuer immediately. Explain what happened and ask whether the card should be cancelled and replaced.
• Watch your account for unauthorized charges, including small “test” transactions.
• Report the domain through your browser’s phishing reporting feature and to the FTC at reportfraud.ftc.gov if you’re in the US.

The simplest defence is also the most effective: if a retailer needs a lookalike domain to sell you something, it’s probably a scam.

Indicators of Compromise (IOCs)

allgoodscenter.shop, allneedsbay.shop, allneedslane.shop, allneedsmarket.shop, allneedsstore.shop, allpurposebay.shop, basketandmore.shop, broadbasket.shop, broadbasketbay.shop, broadbasketco.shop, broadbasketlane.shop, broadbasketplace.shop, broadbasketway.shop, broadchoice.shop, broadgoodsbay.shop, broadgoodscenter.shop, broadgoodsplace.shop, broadgoodsway.shop, broadmarketplacehub.shop, broadutility.shop, broadutilityhub.shop, broadvalue.shop, broadvaluebay.shop, broadvalueplace.shop, cartandcrate.shop, completehomegoods.shop, dailybasketport.shop, dailybasketway.shop, dailychoiceway.shop, dailycrate.shop, dailyfindslane.shop, dailygoodscrest.shop, dailygoodsfield.shop, dailygoodspark.shop, dailygoodsridge.shop, dailygoodsway.shop, dailygoodswayhub.shop, dailyhomemarket.shop, dailyutilitybay.shop, dailyutilityway.shop, everydaycartshop.shop, everydayneedsco.shop, everydayvaluebay.shop, generalcart.shop, generalcartlane.shop, generalgoodsport.shop, generalgoodsridge.shop, generalgoodsway.shop, generalgoodsyard.shop, generalmarketbay.shop, generalmarketfield.shop, generalneedsplace.shop, generalvaluebay.shop, goodsandhomebay.shop, goodsandhomeco.shop, goodsandhomehub.shop, goodsandlivinghub.shop, goodsandmoreco.shop, goodsandvaluehub.shop, goodsdistrict.shop, goodslanding.shop, goodsmeadow.shop, goodsroute.shop, goodsvalley.shop, homeandutility.shop, homebasketlane.shop, homebasketway.shop, homecartcenter.shop, homefieldmarket.shop, homefindsco.shop, homegoodscrate.shop, homegoodsport.shop, homegoodsway.shop, homelivinggoods.shop, homeneedslane.shop, homeneedsmarket.shop, homeparcel.shop, homesteadmart.shop, homeutilitystore.shop, homevaluebay.shop, homevalueplace.shop, homevalueway.shop, marketbasketcenter.shop, marketcanvas.shop, marketchoicebay.shop, marketchoiceplace.shop, marketfieldhub.shop, marketfindsbay.shop, marketfoundry.shop, marketgrovehub.shop, markethomeplace.shop, marketpillar.shop, marketpine.shop, marketridge.shop, markettrailway.shop, marketwarehouse.shop, modernsupplyhub.shop, smartbasketplace.shop, smartdailygoods.shop, smartneedshub.shop, smartutilityhub.shop, smartvaluebay.shop, trustedgoods.shop, usefulbasketlane.shop, usefulcartcenter.shop, usefulchoicebay.shop, usefuldailyhub.shop, usefulgoodsbay.shop, usefulgoodscenter.shop, usefulgoodspark.shop, usefulgoodsway.shop, usefulgoodswayhub.shop, usefulgoodsyard.shop, usefulmarket.shop, usefulmarketbay.shop, usefulshelf.shop, usefulutility.shop, usefulvalueplace.shop, utilitygoods.shop, valuechoicebay.shop, valuegoodspark.shop, valuegoodsridge.shop, valuegrove.shop, valueparcel.shop

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Shoppers browsing on their phones are landing on convincing Walmart lookalike sites offering name-brand liquor at 40% to 70% off, only to be led straight to a checkout page asking for a full credit card number, expiry date, and CVV.

The sites have no connection to Walmart. They’re part of a network of more than 120 near-identical domains built to look like a legitimate retailer just long enough to steal your card details.

Fake Walmart websites

The name “Walmart” is doing most of the work here. It’s one of the most recognized retailers in the world, and it’s that familiarity that makes people lower their guard. A shopper who’d hesitate on an unfamiliar website may think nothing of an unusually large discount because the logo, colours, and layout look familiar.

That trust hasn’t been earned by the site. It’s borrowed from a brand that has nothing to do with it.

If you’ve entered your card details on one of these pages, the safest assumption is that your card has been compromised.

How the scam works

The scam follows a simple pattern: a Walmart-branded homepage, category pages stacked with heavily discounted liquor, and a checkout form asking for full card details.

The discounts do much of the persuading. Seeing premium brands advertised at 60% or 70% off encourages people to buy first and ask questions later.

The same WordPress/WooCommerce template powers every site in the network. They share the same product catalogue, prices, and images. The only differences are fabricated US business addresses and phone numbers that are swapped out for each domain.

How to avoid this scam

• Be sceptical of discounts that don’t match a retailer’s usual promotions, especially on liquor or electronics.
• Check the address bar before entering payment details. A genuine Walmart sale won’t send you to an unfamiliar .shop domain.
• Use tools that can identify scam websites automatically, such as Malwarebytes Browser Guard on desktop, or ask Scam Guard if it thinks a domain is suspicious.
• On mobile, where these sites are designed to work, Malwarebytes Mobile Security can block known phishing and scam domains before you reach the checkout.

If you already entered your card details

• Contact your card issuer immediately. Explain what happened and ask whether the card should be cancelled and replaced.
• Watch your account for unauthorized charges, including small “test” transactions.
• Report the domain through your browser’s phishing reporting feature and to the FTC at reportfraud.ftc.gov if you’re in the US.

The simplest defence is also the most effective: if a retailer needs a lookalike domain to sell you something, it’s probably a scam.

Indicators of Compromise (IOCs)

allgoodscenter.shop, allneedsbay.shop, allneedslane.shop, allneedsmarket.shop, allneedsstore.shop, allpurposebay.shop, basketandmore.shop, broadbasket.shop, broadbasketbay.shop, broadbasketco.shop, broadbasketlane.shop, broadbasketplace.shop, broadbasketway.shop, broadchoice.shop, broadgoodsbay.shop, broadgoodscenter.shop, broadgoodsplace.shop, broadgoodsway.shop, broadmarketplacehub.shop, broadutility.shop, broadutilityhub.shop, broadvalue.shop, broadvaluebay.shop, broadvalueplace.shop, cartandcrate.shop, completehomegoods.shop, dailybasketport.shop, dailybasketway.shop, dailychoiceway.shop, dailycrate.shop, dailyfindslane.shop, dailygoodscrest.shop, dailygoodsfield.shop, dailygoodspark.shop, dailygoodsridge.shop, dailygoodsway.shop, dailygoodswayhub.shop, dailyhomemarket.shop, dailyutilitybay.shop, dailyutilityway.shop, everydaycartshop.shop, everydayneedsco.shop, everydayvaluebay.shop, generalcart.shop, generalcartlane.shop, generalgoodsport.shop, generalgoodsridge.shop, generalgoodsway.shop, generalgoodsyard.shop, generalmarketbay.shop, generalmarketfield.shop, generalneedsplace.shop, generalvaluebay.shop, goodsandhomebay.shop, goodsandhomeco.shop, goodsandhomehub.shop, goodsandlivinghub.shop, goodsandmoreco.shop, goodsandvaluehub.shop, goodsdistrict.shop, goodslanding.shop, goodsmeadow.shop, goodsroute.shop, goodsvalley.shop, homeandutility.shop, homebasketlane.shop, homebasketway.shop, homecartcenter.shop, homefieldmarket.shop, homefindsco.shop, homegoodscrate.shop, homegoodsport.shop, homegoodsway.shop, homelivinggoods.shop, homeneedslane.shop, homeneedsmarket.shop, homeparcel.shop, homesteadmart.shop, homeutilitystore.shop, homevaluebay.shop, homevalueplace.shop, homevalueway.shop, marketbasketcenter.shop, marketcanvas.shop, marketchoicebay.shop, marketchoiceplace.shop, marketfieldhub.shop, marketfindsbay.shop, marketfoundry.shop, marketgrovehub.shop, markethomeplace.shop, marketpillar.shop, marketpine.shop, marketridge.shop, markettrailway.shop, marketwarehouse.shop, modernsupplyhub.shop, smartbasketplace.shop, smartdailygoods.shop, smartneedshub.shop, smartutilityhub.shop, smartvaluebay.shop, trustedgoods.shop, usefulbasketlane.shop, usefulcartcenter.shop, usefulchoicebay.shop, usefuldailyhub.shop, usefulgoodsbay.shop, usefulgoodscenter.shop, usefulgoodspark.shop, usefulgoodsway.shop, usefulgoodswayhub.shop, usefulgoodsyard.shop, usefulmarket.shop, usefulmarketbay.shop, usefulshelf.shop, usefulutility.shop, usefulvalueplace.shop, utilitygoods.shop, valuechoicebay.shop, valuegoodspark.shop, valuegoodsridge.shop, valuegrove.shop, valueparcel.shop

---

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →