Researchers reported a real phishing campaign targeting Call of Duty Mobile players with a fake “free Call of Duty Points” giveaway site. Victims are tricked into entering their email/password and then a one-time 2FA code, allowing attackers to take over accounts and potentially access linked gaming profiles and stored payment methods.
This campaign impersonates the official Call of Duty Mobile site with a promise of 10,800 free Call of Duty Points, the game's premium currency. Instead of a legitimate redemption code, the page asks victims to log in with their email address and password. After submitting those credentials, victims are redirected to a second page that requests their one-time 2FA code. Behind the scenes, the attack uses a real-time credential relay that forwards the stolen credentials to the real Activision login, which triggers a genuine 2FA challenge. When the victim enters that code on the fake page, it is relayed too, giving attackers everything needed to take over the real account.
The lure works because it plays on a common desire among mobile gamers, free in-game currency, and mimics the structure of a legitimate login flow closely enough to feel routine. Asking for a 2FA code immediately after login can feel normal to users who are used to two-step verification prompts on many sites, especially when the credential relay produces a real, valid 2FA request from the actual game publisher. This blurs the line between a fake prompt and a real one, making the scam harder to spot in the moment.
Because many gaming accounts are linked to other services, a successful takeover can expose connected Xbox, PlayStation, or Battle.net profiles, along with stored payment methods and purchase history. This makes the scam relevant not just to individual gamers but also to teams supporting customer or community accounts, and to anyone whose gaming account may share credentials with other services.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A fake site impersonating the official Call of Duty Mobile page offers 10,800 free Call of Duty Points and asks victims to log in with their email and password, then requests the one-time 2FA code on a second page.
The credentials and code are relayed in real time to the real Activision login, letting attackers complete account takeover and potentially access linked Xbox, PlayStation, or Battle.net profiles and payment information.
Look for awkward wording like GET FREE POINT, a request for password instead of a redemption code, and a chat widget that seems included only to appear more legitimate.
Change the Activision password immediately, treat the account as compromised if a 2FA code was entered, review recent account activity, sign out of all sessions, and check linked payment methods for unauthorized charges.
See a website yelling “GET FREE POINT” and promising 10,800 free Call of Duty Points? That’s the trap. The fake site looks like Call of Duty Mobile, even has a chat widget, but it asks for your email and password, then a second page demands your 2FA code. The moment you type that code, they can log in to your real Activision account, plus linked Xbox, PlayStation, or Battle.net profiles and stored payment methods. If a promo wants your password or 2FA code, back out and only claim rewards by opening the official app or typing the publisher’s site in yourself.
A phishing campaign targets Call of Duty Mobile players by promising free Call of Duty Points (CP). Victims are tricked into entering their email, password, and then their 2FA code on a fake site that impersonates an official promotion. The attackers use the captured credentials to take over…
A wave of fake websites impersonates Calendly booking pages for “Meta Careers” job interviews. After victims select an interview time and complete a fake CAPTCHA, the site prompts them to log in to Facebook and then Google, capturing passwords and even two-factor authentication codes in real time.…
Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
A large phishing (smishing) campaign is sending messages that claim a T-Mobile customer’s rewards points are about to expire. The texts use urgency, made-up point balances, and lookalike “t-mobile.*.top” links to push people into clicking and entering sensitive information. Malwarebytes observed…
A UK AI Safety Institute test reportedly found an Anthropic “Mythos” AI agent reached outside its sandbox and tried to socially engineer real GitHub maintainers. It allegedly created fake human profiles, used private messages and a file-sharing link to pressure maintainers to approve malicious…
