Scammers Tell T-Mobile Users Their Rewards Are Expiring to Trick Them Into Clicking Phishing Links
Malwarebytes tracked a large T-Mobile smishing campaign using 81+ rotating .top domains and 1,000+ template variants to harvest credentials via fake rewards-expiry lures.
Malwarebytes has tracked an SMS phishing campaign impersonating T-Mobile since early May 2026, using lures about expiring rewards points (e.g., a claimed 18,400-point balance) to push victims to lookalike domains such as t-mobile.biktpw[.]top. Researchers identified at least 81 short-lived .top domains and more than 1,000 semantically similar message templates, with the 199 closest variants scoring 0.95+ similarity. Links lead to fake login, personal-data, or payment pages aimed at credential harvesting, and attackers may also request one-time verification codes to enable account takeover despite MFA. Users are advised to verify notifications inside the official app and report suspicious texts to 7726.
- 81+ short-lived .top lookalike domains rotate to evade domain-based blocking
- 1,000+ message templates share semantic similarity of at least 0.60; 199 score 0.95+
- Fake pages harvest credentials, card details, and one-time codes for account takeover
- Generic greetings and mismatched domains are key detection signals
- Victims should verify via the official app and report texts to 7726
- Vendors
- T-MobileMalwarebytes
- Products
- T-Mobile Rewards
- Victims
- T-Mobile customers
- Organizations
- T-Mobile
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | biktpw.top | s used across four months, with examples including t-mobile.biktpw[.]top , t-mobile.cugbjl[.]top , and t-mobile.gdikxv[.]top . The |
| domain | cugbjl.top | s, with examples including t-mobile.biktpw[.]top , t-mobile.cugbjl[.]top , and t-mobile.gdikxv[.]top . The rapidly changing infras |
| domain | cymfjd.top | 1 t-mobile.biktpw[.]top 2 t-mobile.cugbjl[.]top 3 t-mobile.cymfjd[.]top 4 t-mobile.gdikxv[.]top 5 t-mobile.hdzcnb[.]top 6 t-mobil |
| domain | gdikxv.top | -mobile.biktpw[.]top , t-mobile.cugbjl[.]top , and t-mobile.gdikxv[.]top . The rapidly changing infrastructure complicates simple |
| domain | hdzcnb.top | 3 t-mobile.cymfjd[.]top 4 t-mobile.gdikxv[.]top 5 t-mobile.hdzcnb[.]top 6 t-mobile.koxetp[.]top 7 t-mobile.nxdcfp[.]top 8 t-mobil |
| domain | koxetp.top | 4 t-mobile.gdikxv[.]top 5 t-mobile.hdzcnb[.]top 6 t-mobile.koxetp[.]top 7 t-mobile.nxdcfp[.]top 8 t-mobile.pkrbai[.]top Note: IP |
| domain | nxdcfp.top | 5 t-mobile.hdzcnb[.]top 6 t-mobile.koxetp[.]top 7 t-mobile.nxdcfp[.]top 8 t-mobile.pkrbai[.]top Note: IP addresses and domains ar |
| domain | pkrbai.top | 6 t-mobile.koxetp[.]top 7 t-mobile.nxdcfp[.]top 8 t-mobile.pkrbai[.]top Note: IP addresses and domains are intentionally defanged |
| domain | t-mobile.com | ile should not route users to a domain that is unrelated to t-mobile.com . Users should treat any reward-redemption link pointing to |
From the original article
4 min read at gbhackers.com
A large-scale SMS phishing campaign is impersonating T-Mobile and warning recipients that their “rewards points” are about to expire, using fabricated balances, urgent deadlines, and lookalike redemption links to steal sensitive information. Security researchers have tracked the operation since early May 2026 and continue to observe new message variants despite a decline from its peak […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.