Fake $750 Apple Cash Offer Pays Nothing

Malwarebytes · Medium sophistication
Last updated November 4, 2026

Researchers found a fake Apple Cash reward page that promises $750 after a supposed device verification. Instead of paying users, it pushes them through affiliate links to install apps, create accounts, and play games while using fake verification steps and countdown pressure. The page is not affiliated with Apple and may expose users to unwanted data sharing or in-app spending.

Key findings

  • A fake website promised users $750 in Apple Cash for completing a fraudulent three-step device-verification process.
  • The site impersonated Apple by calling an app an “Official Apple Partner,” claiming it was “Verified by Apple Cash,” and displaying “Copyright © 2026 Apple Inc.”
  • The supposed eligibility check, device verification, claimed-reward pop-ups, remaining-spots counter, and session-expiry timer were scripted and did not verify anything.
  • Users were directed to download Reco Social, create an account, and install and play a game; researchers found no evidence that Reco Social or its developer operated the fake page.
  • The download and reward buttons routed users through taprkr[.]com affiliate-tracking links, suggesting operators could profit from registrations, installs, or in-app spending.
  • The scam can collect personal information through app registration and may prime victims for later scams requesting Apple Account details, payment-card data, or a processing fee.

Who’s being targeted

  • Commonly targeted roles: All employees, Mobile device users, Apple device users, Customer service teams, Finance and digital-wallet users.
  • Affected industries: Consumer technology, Mobile applications and gaming, Online advertising and affiliate marketing, Financial services and digital wallets.
  • Attack channels: website.
  • Impersonated: Apple / Apple Cash.

Awareness takeaways

  • Treat a reward offer that requires installing an unrelated app, opening an account, or playing a game as suspicious, especially when it promises Apple Cash or gift-card value.
  • Verify Apple-related offers independently through Apple’s official apps or apple.com, rather than using links in ads, posts, or unexpected messages.
  • Do not let countdowns, limited-availability claims, or alleged recent winners rush you into clicking or installing software.
  • If someone installed an app after following a fake reward offer, remove the app, delete the account if possible, review subscriptions, and change any reused password.

Red flags to watch for

  • The offer promises a large cash reward for installing an unrelated third-party app.
  • The page uses false urgency, including “Only 47 spots left today” and a “Session Expires” countdown.
  • The offer is not on apple.com and routes through a tracking link rather than directly to the App Store.
  • The number of available spots is artificially generated and never truly runs out.
  • Claim notifications use random names and states rather than real customer activity.
  • The session timer does not change the outcome when it reaches zero.
Try Mirage

Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.

Get a demo
Read the video transcript

$750 in Apple Cash for a quick device check? Hold on. This fake page says 'Verified by Apple Cash,' then sends you to download Reco Social, create an account, and play a game. That's not device verification. Aha: the button routes through taprkr dot com, an affiliate-tracking link, not straight to the App Store. 'Only 47 spots left' and the countdown? Scripted pressure. If an Apple Cash offer asks for an unrelated app, skip its links. Open apple.com yourself to check.

Similar attacks

Fake Amazon Music Deal Steals Creator Logins

Fake Amazon Music Deal Steals Creator Logins

A phishing campaign targets YouTube creators with a fake, invite-only Amazon Music advertising deal. The fraudulent site uses each creator’s real public channel statistics to appear legitimate, then places a fake Google sign-in screen over the page to capture Google passwords and multi-factor…

October 21, 2026
Fake Claude Payments and Updates Target Users

Fake Claude Payments and Updates Target Users

Cybercriminals impersonated well-known technology brands including Claude, Google, Apple, and Docusign to steal credentials, payment details, or gain access to devices. The lures used urgent payment failures, software-update prompts, and promised device-performance improvements to persuade people…

October 19, 2026
Fake Claude Max Promo Steals Google Logins

Fake Claude Max Promo Steals Google Logins

Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…

September 23, 2026
Fake SSO + MFA Push Used in Real Breaches

Fake SSO + MFA Push Used in Real Breaches

This weekly roundup includes two real social-engineering-driven incidents. Attackers used social engineering to access Apollo Global Management’s cloud platforms and steal sensitive personal data, and separately attempted a ShinyHunters phishing attack against ReliaQuest using a fake SSO login page…

August 28, 2026
Fake GitHub Lure Tricks macOS Users Into Stealer

Fake GitHub Lure Tricks macOS Users Into Stealer

Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…

August 17, 2026
Invitation Emails Used to Steal Logins & Install RATs

Invitation Emails Used to Steal Logins & Install RATs

Cofense reports a sustained rise in real phishing campaigns disguised as party/event invitations that trick people into clicking links. The same invitation lure is being used both to steal usernames/passwords via fake login pages and to install legitimate-but-abused remote access tools that give…

August 12, 2026