Hackers Use Fake T-Mobile Rewards Expiry Texts to Lure Users to Phishing Sites
Malwarebytes tracks a T-Mobile smishing campaign using 1,000+ fake rewards-expiry text templates and 81+ disposable .top domains to steal credentials and payment data.
Malwarebytes has tracked a widespread T-Mobile smishing campaign since early May 2026 that uses fake rewards-expiry texts claiming balances such as 18,400 points will vanish within a day. Analysts identified more than 1,000 closely related message templates, with attackers rotating greetings, balances, dates, and links to evade detection. Links route through at least 81 short-lived .top domains over four months to pages harvesting logins, payment data, and one-time verification codes. Users are urged to verify claims through official apps and avoid links in unsolicited texts.
- Campaign active since early May 2026, using urgent fake balances like 18,400 points expiring the same day.
- Over 1,000 related text templates and 81+ short-lived .top domains complicate blocklisting.
- Phishing pages harvest logins, card data, and one-time verification codes from T-Mobile customers.
- Users should verify via official apps, avoid embedded links, and never share one-time codes.
- Vendors
- T-MobileMalwarebytes
- Organizations
- T-MobileMalwarebytes
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | biktpw.top | promise (IoCs):- Type Indicator Description Domain t-mobile.biktpw[.]top Example phishing domain following the campaign’s T-Mobile |
| domain | cugbjl.top | e campaign’s T-Mobile impersonation pattern Domain t-mobile.cugbjl[.]top Example phishing domain following the campaign’s T-Mobile |
| domain | cymfjd.top | e campaign’s T-Mobile impersonation pattern Domain t-mobile.cymfjd[.]top Example phishing domain following the campaign’s T-Mobile |
| domain | gdikxv.top | e campaign’s T-Mobile impersonation pattern Domain t-mobile.gdikxv[.]top Example phishing domain following the campaign’s T-Mobile |
| domain | hdzcnb.top | e campaign’s T-Mobile impersonation pattern Domain t-mobile.hdzcnb[.]top Example phishing domain following the campaign’s T-Mobile |
| domain | koxetp.top | e campaign’s T-Mobile impersonation pattern Domain t-mobile.koxetp[.]top Example phishing domain following the campaign’s T-Mobile |
| domain | nxdcfp.top | e campaign’s T-Mobile impersonation pattern Domain t-mobile.nxdcfp[.]top Example phishing domain following the campaign’s T-Mobile |
| domain | pkrbai.top | e campaign’s T-Mobile impersonation pattern Domain t-mobile.pkrbai[.]top Example phishing domain following the campaign’s T-Mobile |
| domain | qfrhkt.top | e campaign’s T-Mobile impersonation pattern Domain t-mobile.qfrhkt[.]top Example phishing domain following the campaign’s T-Mobile |
| domain | qscizj.top | e campaign’s T-Mobile impersonation pattern Domain t-mobile.qscizj[.]top Example phishing domain following the campaign’s T-Mobile |
| domain | tmfncb.top | e campaign’s T-Mobile impersonation pattern Domain t-mobile.tmfncb[.]top Example phishing domain following the campaign’s T-Mobile |
| domain | vmnqsu.top | e campaign’s T-Mobile impersonation pattern Domain t-mobile.vmnqsu[.]top Example phishing domain following the campaign’s T-Mobile |
From the original article
4 min read at cybersecuritynews.com
A widespread text-message phishing campaign is posing as T-Mobile to pressure customers into visiting fraudulent reward-redemption pages. The messages claim that loyalty points are about to expire, turning an ordinary account reminder into a trap for login details, personal data, payment information, and verification codes. The activity has been tracked since early May 2026 and […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.