Search: “element”

3 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 5 AI industry 4 Threat actor 4 Malware 3 Phishing & fraud 3 Model release 3 Industry 2 AI research 2 Data breach 2 Exploit / PoC 2 Advisory 2 Research 2 Tools 1 AI policy 1

SeverityAll critical 0 high 7 medium 12 low 0 info 17

T-Mobile rewards points expiry texts are a phishing scam

Malwarebytes tracks an SMS phishing campaign, active since May 2026, impersonating T-Mobile rewards expiry with 1,000+ templates and 81 rotating domains to lure victims.

Malwarebytes Labs has monitored a large smishing campaign since early May 2026 that falsely claims recipients' T-Mobile Rewards points are expiring, using invented balances like 18,400 points and imminent deadlines to create urgency. Researchers identified more than 1,000 semantically similar message templates (199 scoring at least 0.95 similarity) that vary only in salutation, headline, expiry date, and point balance. The links resolve to rotating domains such as t-mobile.biktpw[.]top, with at least 81 short-lived domains observed over four months, pushing victims to fake redemption pages where they may enter credentials or payment details. Activity peaked in two large spikes and has since declined, though messages are still circulating.

Malwarebytes Labs10:44 UTC · 3h agoPhishing & fraud in the wild

Phishing Attacks Abuse Trusted Email Infrastructure and URL Cloaking to Evade Security Filters

VBSpam Q3 2026 test shows phishers abusing DKIM-aligned domains, Amazon SES, and multi-stage URL cloaking to defeat email filters.

Virus Bulletin's Q3 2026 VBSpam test (AMTSO-LS1-TP207) found phishing campaigns moving payloads past the email itself via browser-fingerprinting gates, redirect chains, and hidden POST requests. Examples include a Dutch McAfee/TotalAV scareware renewal scam, a German overdue-payment Web3 fraud delivered via Amazon SES from DKIM-aligned moolaah.com, and Romanian BCR PSD2 credential phishing embedding IPv6-mapped URLs resolving to 103.193.179.223. Net at Work NoSpamProxy ranked first with a 99.995 score while open-source Rspamd caught only 62.55% of phishing mail.

GBHackersSep 15, 13:04 UTC · 2d agoPhishing & fraud in the wild 2 sources

Search results are sending people to fake Bitrefill checkouts

Scam sites impersonating Bitrefill's crypto checkout appear in search results, tricking victims into sending up to $1,990 in crypto directly to scammers.

Malwarebytes documents a cluster of lookalike domains copying Bitrefill's gift card checkout, surfaced via search engine results rather than email. Victims choose an amount up to $1,990 and pay in Bitcoin, Ethereum, USDC, USDT, Solana, or Litecoin to scammer-controlled addresses, with no recourse since crypto payments are irreversible. Domains use typosquatting and Punycode/IDN homoglyph tricks, and the fake sites run commercial analytics software to measure and optimize victim conversion. Bitrefill's security team is working with takedown specialists to remove the sites.

Malwarebytes LabsSep 15, 08:40 UTC · 2d agoPhishing & fraud