A large phishing (smishing) campaign is sending messages that claim a T-Mobile customer’s rewards points are about to expire. The texts use urgency, made-up point balances, and lookalike “t-mobile.*.top” links to push people into clicking and entering sensitive information. Malwarebytes observed heavy templating and fast-rotating domains, indicating an organized, ongoing operation.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
If you get a text saying, “T‑Mobile Rewards Points Reminder: Your Points Are About to Expire”, pause. There’s a big smishing campaign faking T‑Mobile rewards, claiming you’ve got things like 18,400 points expiring today, and pushing you to tap a link like t-mobile.s8k9.top/pay. The trick: more than a thousand text templates, all the same story, points expiring, generic greeting, and that lookalike t-mobile..top link, then a fake page asking for your login, payment info, or verification codes. Here’s the move: if a text says your points are expiring, don’t tap the link, open the real T‑Mobile app or website yourself and check your rewards there.
Following a Revolut data breach, scammers sent text messages that appeared to come from the same message thread as legitimate Revolut texts. The texts pushed victims to click a link for a fake identity “liveness check,” request camera access, and then capture passwords, information that could be…
Days after Revolut disclosed that customer records were shared with an unauthorized party, some customers reported receiving phishing texts that appeared in the same SMS thread as real Revolut messages. The link led to a fake site that asked for camera access to mimic Revolut’s identity “liveness”…
Microsoft says it used a U.S. court order to seize and redirect domains tied to three Chinese-run phishing platforms that helped send hundreds of millions of scam messages worldwide. The platforms provided ready-made fake pages and messages impersonating trusted organizations, mainly to steal…
A wave of fake websites impersonates Calendly booking pages for “Meta Careers” job interviews. After victims select an interview time and complete a fake CAPTCHA, the site prompts them to log in to Facebook and then Google, capturing passwords and even two-factor authentication codes in real time.…
Researchers found a real phishing campaign offering a “free” Claude Max upgrade to trick people into signing in with Google. The site uses a fake, draggable Google login pop-up (“browser-in-the-browser”) that looks legitimate and captures credentials. A stolen Google account can expose email and…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
