Malwarebytes reports that scammers are increasingly tailoring different scams to the platforms where they work best, like unpaid-toll lures via email/SMS, romance scams via social media, and IRS scams via phone calls. The report highlights heavy brand and celebrity impersonation (including MrBeast) and suggests scammers time campaigns for maximum response, such as lunchtime and Fridays in the U.S.
Malwarebytes data shows scammers are not using a one-size-fits-all approach. Instead, they tailor scam type to the channel where it performs best. Toll scams, which threaten fines or license suspension, arrive by email or text in nine out of ten cases. Romance scams tend to start on social media, where trust can be built over time through a profile and ongoing messages. IRS scams frequently use a phone call, with about half of all reported IRS scams arriving that way. This channel matching lets scammers exploit the specific dynamics of each platform, whether it is the immediacy of a text message or the perceived authority of a phone call.
Impersonation of trusted names adds credibility to these lures. Malwarebytes found that MrBeast is currently the most impersonated person in its data, used in scams ranging from crypto giveaways to transfer fee swindles that ask victims to send money as part of a fake verification step. Major brands including Google, Microsoft, Apple, Roblox, and Amazon are also frequently impersonated. Timing plays a role too: scam texts to Americans peak around 12:00 pm ET and are highest on Fridays, suggesting scammers schedule campaigns for when people are more likely to respond quickly, such as during a lunch break or at the start of a weekend.
Malwarebytes' guidance centers on verifying independently rather than trusting the message or call itself. If a toll or billing notice seems suspicious, go directly to the official website or account instead of using the link in the message. For unsolicited calls, avoid sharing PINs, passwords, or verification codes, and hang up to call back using an official number. For social media posts claiming a celebrity giveaway, remember that legitimate prizes do not require sending money first. Gaming communities such as Roblox and Steam have also seen notable spikes in scam activity, so users in those communities should apply the same skepticism to unsolicited offers and requests for payment.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Malwarebytes found that nine in ten toll scams, which threaten fines or license suspension, arrive by email or text because those channels create urgency and push victims to click a payment link quickly.
Malwarebytes data shows MrBeast is the most impersonated person, with scammers using his likeness for crypto giveaways and transfer fee swindles that ask victims to send money as a verification step.
According to Malwarebytes, half of all IRS scams arrive via a phone call, often pressuring the target to share personal details, PINs, passwords, or payment information immediately.
Malwarebytes reports that scam texts to Americans peak around 12:00 pm ET and are highest on Fridays, suggesting scammers time messages for maximum response.
Scams aren’t random anymore, they’re customized to where you are: text, email, socials, even gaming. Example one: A fake unpaid-toll email or text saying, “Pay now or your license gets suspended,” with a link to “resolve it.” Nine in ten of these toll scams arrive exactly like that, by email or SMS. Example two: A fake giveaway site using a MrBeast-style thumbnail in your feed, telling you you’ve won, but you must send crypto or a “verification fee” first. Malwarebytes says “MrBeast” is now the most impersonated person for these swindles. Here’s the move: if any message says “pay this toll” or “send money to verify a prize,” don’t tap the link, go to the official site or app yourself and check there instead.
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Attackers are exploiting GTA 6 hype by creating convincing fake Rockstar-branded “demo” websites that appear in Google search results. The sites use “Play Now”/“Official Download” lures to trick people into downloading a small Windows executable that installs Vidar infostealer and steals saved…
Researchers say a Chinese-speaking cybercrime group compromised Brazilian government and education websites and used them as “trusted” entry points to quietly redirect visitors to attacker-run phishing pages. The fake pages impersonated well-known app stores (Google Play, Microsoft Store, Amazon)…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
The article describes real-world ways attackers get around multifactor authentication (MFA), including “push bombing” (MFA fatigue), phishing pages that relay codes in real time, SIM swapping, and stealing session cookies so MFA isn’t needed again. It also cites known incidents (e.g., Uber 2022 MFA…
