Malwarebytes reports that scammers are increasingly tailoring different scams to the platforms where they work best, like unpaid-toll lures via email/SMS, romance scams via social media, and IRS scams via phone calls. The report highlights heavy brand and celebrity impersonation (including MrBeast) and suggests scammers time campaigns for maximum response, such as lunchtime and Fridays in the U.S.
Malwarebytes data shows scammers are not using a one-size-fits-all approach. Instead, they tailor scam type to the channel where it performs best. Toll scams, which threaten fines or license suspension, arrive by email or text in nine out of ten cases. Romance scams tend to start on social media, where trust can be built over time through a profile and ongoing messages. IRS scams frequently use a phone call, with about half of all reported IRS scams arriving that way. This channel matching lets scammers exploit the specific dynamics of each platform, whether it is the immediacy of a text message or the perceived authority of a phone call.
Impersonation of trusted names adds credibility to these lures. Malwarebytes found that MrBeast is currently the most impersonated person in its data, used in scams ranging from crypto giveaways to transfer fee swindles that ask victims to send money as part of a fake verification step. Major brands including Google, Microsoft, Apple, Roblox, and Amazon are also frequently impersonated. Timing plays a role too: scam texts to Americans peak around 12:00 pm ET and are highest on Fridays, suggesting scammers schedule campaigns for when people are more likely to respond quickly, such as during a lunch break or at the start of a weekend.
Malwarebytes' guidance centers on verifying independently rather than trusting the message or call itself. If a toll or billing notice seems suspicious, go directly to the official website or account instead of using the link in the message. For unsolicited calls, avoid sharing PINs, passwords, or verification codes, and hang up to call back using an official number. For social media posts claiming a celebrity giveaway, remember that legitimate prizes do not require sending money first. Gaming communities such as Roblox and Steam have also seen notable spikes in scam activity, so users in those communities should apply the same skepticism to unsolicited offers and requests for payment.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Malwarebytes found that nine in ten toll scams, which threaten fines or license suspension, arrive by email or text because those channels create urgency and push victims to click a payment link quickly.
Malwarebytes data shows MrBeast is the most impersonated person, with scammers using his likeness for crypto giveaways and transfer fee swindles that ask victims to send money as a verification step.
According to Malwarebytes, half of all IRS scams arrive via a phone call, often pressuring the target to share personal details, PINs, passwords, or payment information immediately.
Malwarebytes reports that scam texts to Americans peak around 12:00 pm ET and are highest on Fridays, suggesting scammers time messages for maximum response.
Scams aren’t random anymore, they’re customized to where you are: text, email, socials, even gaming. Example one: A fake unpaid-toll email or text saying, “Pay now or your license gets suspended,” with a link to “resolve it.” Nine in ten of these toll scams arrive exactly like that, by email or SMS. Example two: A fake giveaway site using a MrBeast-style thumbnail in your feed, telling you you’ve won, but you must send crypto or a “verification fee” first. Malwarebytes says “MrBeast” is now the most impersonated person for these swindles. Here’s the move: if any message says “pay this toll” or “send money to verify a prize,” don’t tap the link, go to the official site or app yourself and check there instead.
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
Attackers are exploiting GTA 6 hype by creating convincing fake Rockstar-branded “demo” websites that appear in Google search results. The sites use “Play Now”/“Official Download” lures to trick people into downloading a small Windows executable that installs Vidar infostealer and steals saved…
Microsoft reports disrupting a Chinese-language “phishing-as-a-service” ecosystem that sold phishing kits and “legitimate-looking” cloud infrastructure to criminals worldwide. The operation enabled large-scale email and SMS phishing that impersonated trusted brands (government, delivery,…
This weekly bulletin highlights multiple real-world incidents, including phishing and impersonation campaigns. Notably, researchers found attackers using malicious “Custom GPTs” on ChatGPT to redirect victims to a Google Sites page and trick them into running commands that install remote-access…
Researchers found a phishing campaign offering a “free” upgrade to Claude Max to trick people into signing in with Google. The page uses a convincing fake, draggable Google login window (“browser-in-the-browser”) to capture credentials, potentially giving criminals access to email, documents, and…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
