A large phishing (smishing) campaign is sending messages that claim a T-Mobile customer’s rewards points are about to expire. The texts use urgency, made-up point balances, and lookalike “t-mobile.*.top” links to push people into clicking and entering sensitive information. Malwarebytes observed heavy templating and fast-rotating domains, indicating an organized, ongoing operation.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
If you get a text saying, “T‑Mobile Rewards Points Reminder: Your Points Are About to Expire”, pause. There’s a big smishing campaign faking T‑Mobile rewards, claiming you’ve got things like 18,400 points expiring today, and pushing you to tap a link like t-mobile.s8k9.top/pay. The trick: more than a thousand text templates, all the same story, points expiring, generic greeting, and that lookalike t-mobile..top link, then a fake page asking for your login, payment info, or verification codes. Here’s the move: if a text says your points are expiring, don’t tap the link, open the real T‑Mobile app or website yourself and check your rewards there.
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
The article describes real intrusions where attackers impersonate a company helpdesk and lure employees into "passkey, MFA, or SSO setup" steps. Victims are sent links via text (often to personal phones), leading to account takeover through adversary-in-the-middle phishing or device-code…
Researchers say a phishing-as-a-service platform called AnonyMousKIT targets people who recently lost or had an iPhone stolen by pretending to be “Apple Support.” The operation uses email/SMS/WhatsApp and AI-assisted voice calls to convince victims to share their iPhone passcode and follow a…
Scammers are setting up fake Fortnite “rewards,” “locker value,” and “competition” websites that funnel players to a fake Epic Games login page. The sites trick people into signing in so attackers can steal Epic usernames and passwords, then take over accounts for resale, fraud, or further scams. A…
A real phishing campaign impersonated postal couriers (including Belgium’s bpost) to trick people into paying a small “customs fee” for an undelivered parcel. Victims were sent to a fake courier website that collected personal details, then escalated to stealing full card and banking (IBAN)…
Microsoft warns of an active social engineering campaign where attackers pose as an IT help desk and pressure employees to “update” passkeys/MFA/SSO. Victims are sent to fake Microsoft sign-in pages or tricked into approving access via device-code login, enabling attackers to add their own MFA…
