T-Mobile rewards points expiry texts are a phishing scam
Malwarebytes tracks an SMS phishing campaign, active since May 2026, impersonating T-Mobile rewards expiry with 1,000+ templates and 81 rotating domains to lure victims.
Malwarebytes Labs has monitored a large smishing campaign since early May 2026 that falsely claims recipients' T-Mobile Rewards points are expiring, using invented balances like 18,400 points and imminent deadlines to create urgency. Researchers identified more than 1,000 semantically similar message templates (199 scoring at least 0.95 similarity) that vary only in salutation, headline, expiry date, and point balance. The links resolve to rotating domains such as t-mobile.biktpw[.]top, with at least 81 short-lived domains observed over four months, pushing victims to fake redemption pages where they may enter credentials or payment details. Activity peaked in two large spikes and has since declined, though messages are still circulating.
- Campaign uses fake rewards-point expiry warnings with invented balances and urgent deadlines
- Over 1,000 closely related SMS templates detected, differing only in superficial elements
- At least 81 rotating .top domains used over four months, each very short-lived
- Victims urged to follow links to redeem points, risking credential and payment theft
- Malwarebytes Mobile Security Text Protection telemetry and Browser Guard blocks underpin the analysis
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | biktpw.top | domains showing the pattern used by the campaign: t-mobile.biktpw[.]top t-mobile.cugbjl[.]top t-mobile.cymfjd[.]top t-mobile.gdik |
| domain | cugbjl.top | attern used by the campaign: t-mobile.biktpw[.]top t-mobile.cugbjl[.]top t-mobile.cymfjd[.]top t-mobile.gdikxv[.]top t-mobile.hdzc |
| domain | cymfjd.top | paign: t-mobile.biktpw[.]top t-mobile.cugbjl[.]top t-mobile.cymfjd[.]top t-mobile.gdikxv[.]top t-mobile.hdzcnb[.]top t-mobile.koxe |
| domain | gdikxv.top | [.]top t-mobile.cugbjl[.]top t-mobile.cymfjd[.]top t-mobile.gdikxv[.]top t-mobile.hdzcnb[.]top t-mobile.koxetp[.]top t-mobile.nxdc |
| domain | hdzcnb.top | [.]top t-mobile.cymfjd[.]top t-mobile.gdikxv[.]top t-mobile.hdzcnb[.]top t-mobile.koxetp[.]top t-mobile.nxdcfp[.]top t-mobile.pkrb |
| domain | koxetp.top | [.]top t-mobile.gdikxv[.]top t-mobile.hdzcnb[.]top t-mobile.koxetp[.]top t-mobile.nxdcfp[.]top t-mobile.pkrbai[.]top t-mobile.qfrh |
| domain | nxdcfp.top | [.]top t-mobile.hdzcnb[.]top t-mobile.koxetp[.]top t-mobile.nxdcfp[.]top t-mobile.pkrbai[.]top t-mobile.qfrhkt[.]top t-mobile.qsci |
| domain | pkrbai.top | [.]top t-mobile.koxetp[.]top t-mobile.nxdcfp[.]top t-mobile.pkrbai[.]top t-mobile.qfrhkt[.]top t-mobile.qscizj[.]top t-mobile.tmfn |
| domain | qfrhkt.top | [.]top t-mobile.nxdcfp[.]top t-mobile.pkrbai[.]top t-mobile.qfrhkt[.]top t-mobile.qscizj[.]top t-mobile.tmfncb[.]top t-mobile.vmnq |
| domain | qscizj.top | [.]top t-mobile.pkrbai[.]top t-mobile.qfrhkt[.]top t-mobile.qscizj[.]top t-mobile.tmfncb[.]top t-mobile.vmnqsu[.]top Stop threats |
| domain | tmfncb.top | [.]top t-mobile.qfrhkt[.]top t-mobile.qscizj[.]top t-mobile.tmfncb[.]top t-mobile.vmnqsu[.]top Stop threats before they can do any |
| domain | vmnqsu.top | [.]top t-mobile.qscizj[.]top t-mobile.tmfncb[.]top t-mobile.vmnqsu[.]top Stop threats before they can do any harm. Malwarebytes Br |
From the original article
3 min read at malwarebytes.com
A large phishing campaign is using fake T-Mobile rewards points and looming expiry dates to pressure recipients into clicking malicious links.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.