Scammers are using lookalike Bitrefill domains that appear in search results to trick people into buying gift cards or top-ups. The fake sites copy Bitrefill’s branding and checkout flow, then display a QR code and crypto address so victims unknowingly pay the scammers instead of Bitrefill. Because crypto payments can’t usually be reversed, victims typically lose the funds and receive nothing.
This campaign relies on search results rather than email or phone calls. Someone searching for "Bitrefill" or a "Bitrefill gift card" clicks a top result that looks legitimate but actually leads to a lookalike domain. The fake site closely copies Bitrefill's branding and checkout flow, walking the visitor through what feels like a normal gift card or top-up purchase. At the payment step, the page shows a QR code, a one-time-use crypto address, and a countdown clock giving the visitor under an hour to send funds. The only real difference from a legitimate purchase is where the money goes: instead of reaching Bitrefill, it goes directly to an address controlled by the scammers.
The operation appears built like a polished e-commerce funnel rather than a quick, one-off scam page. Key findings note the use of commercial analytics software alongside the lookalike checkout, suggesting the operators are tracking and optimizing conversion the way a legitimate retailer would. Typosquatted domains and internationalized (Punycode) addresses make the URLs look correct at a glance, and because the checkout mirrors Bitrefill's real flow so closely, there is little in the visual experience itself to signal a problem. The countdown timer and preset payment amounts add urgency that discourages a careful second look.
Treat search results for payment and checkout pages as untrusted, even when they rank near the top. The safest approach is to use a saved bookmark or type the address directly rather than clicking through search listings. Before approving any payment, confirm that the domain is exactly the one the company uses, since seeing the right brand name somewhere in the URL is not enough to confirm legitimacy. Because cryptocurrency payments generally cannot be reversed, this verification needs to happen before funds are sent, not after. Anyone who buys gift cards, eSIMs, or digital goods on behalf of their organization, including finance and procurement staff, should build this domain check into routine purchasing habits. Finally, be cautious of any follow-up offer promising to recover lost cryptocurrency for an upfront fee, since these recovery services are often a second scam layered on top of the first.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Scammers register lookalike domains, sometimes using typosquatting or internationalized Punycode addresses, that appear in search results and closely copy Bitrefill's branding and checkout flow.
Victims complete what looks like a normal purchase, but instead of paying Bitrefill they send cryptocurrency to a QR code and address controlled by scammers, with little chance of recovery.
Cryptocurrency payments generally cannot be reversed or charged back, so recovery is unlikely once funds are sent to the scammer's address.
Watch for domains that are not exactly bitrefill.com, extra words like pay or gift added to the brand name, internationalized domains that resemble the real one, and countdown timers pressuring quick payment.
You Google “Bitrefill gift card,” click the top result, and the site looks exactly like Bitrefill… but it isn’t. These fake Bitrefill sites copy the logo, colors, and checkout flow. You pick an amount, enter your email, and it all feels normal, until you hit a payment screen that’s actually wired to the scammers. The aha: the only real difference is the crypto address. The fake Bitrefill checkout shows a QR code, a one-time-use address, and a countdown clock, once you send, that crypto goes straight to them, and you’re not getting it back. Before you send any crypto, stop and read the address bar. Type bitrefill.com yourself or use a bookmark, never trust a checkout you reached from a search result alone.
A scam campaign uses full-screen browser popups impersonating Apple Support or Amazon to claim an “unauthorized” $149.99 charge and pressure victims to call a phone number. Callers reach a live scammer posing as support who tries to gain remote access or steal payment/account details, sometimes…
Scammers posing as HR staff at major brands are luring targets into an interview “scheduling” flow that ultimately steals corporate passwords on mobile devices. The campaign uses a browser-in-the-browser style approach (or a full-screen fake login on phones) and even blocks personal email logins to…
A real “fake recruiter” phishing campaign (tracked as RecruitTrap) is targeting employees’ corporate credentials, especially on mobile devices. The scam uses lookalike recruitment domains and full-screen fake login pages that hide browser cues, and it rejects personal email addresses to focus on…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
Check Point reports that OpenAI’s ChatGPT became a top-10 most impersonated brand in Q2 2026 phishing. One observed example used a fake “ChatGPT Plus payment failed” billing email to drive victims to a credit-card theft page. The report also notes other brand-impersonation scams using cloned stores…
