Loading story…
Multiple consumer-facing fraud campaigns are circulating that use fake online stores, impersonation, and social-media marketplace deception to steal money and potentially harvest personal/financial data. One campaign uses “That’s my shit” as a recurring phrase/branding for fraudulent storefronts that copy legitimate creators’ images and videos to sell counterfeit or non-existent merchandise; victims report non-delivery, low-quality goods, or exposure of personal and payment information during checkout.
Separately, a phishing-style email scam impersonates Kroll by referencing class-action settlements and crypto/FTX themes to entice recipients to engage; the message appears to be sent via a legitimate email-sending infrastructure (notably a Shopify-associated domain with passing SPF/DKIM/DMARC), illustrating how attackers can abuse reputable platforms/domains to increase credibility. Another active scam targets would-be pet buyers through fake “Cats of Albany” Facebook groups/ads, pushing victims to pay deposits via PayPal Friends and Family (no buyer protection) for kittens that do not exist, then escalating fees (shipping/insurance/crates) before disappearing.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
By 2026-03-21, orodeals.com was being identified as a fraudulent website posing as a Target rewards offer, falsely promising a $750 discount or similar reward. The site redirected visitors to related scam pages and fake survey flows while collecting email addresses and potentially other personal information for spam or follow-on fraud.
By 2026-03-12, a phishing scam impersonating Kroll and referencing FTX was using emails sent through legitimate-looking infrastructure to direct recipients through redirects to a newly registered phishing site. The site prompted users to connect cryptocurrency wallets via a WalletConnect-style flow, likely to enable theft of wallet assets.
By 2026-03-12, scam online stores using the phrase “That’s my shit” were repurposing stolen graphics and videos from legitimate creators to market counterfeit or nonexistent merchandise. Victims risked losing money, receiving poor-quality goods, or exposing personal and financial information.
By 2026-03-11, scammers were operating fake Albany-area pet-themed Facebook groups and ads, such as “Cats of Albany,” to sell nonexistent kittens. The fraud used unusually low rehoming fees and pushed victims to send deposits and extra charges via PayPal Friends and Family, reducing refund options.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
onlinethreatalerts.com
Open sourceonlinethreatalerts.com
Open sourceblog.knowbe4.com
Open sourceonlinethreatalerts.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports describe **social-engineering scams** that impersonate trusted brands and payment providers to drive victims into credential theft or direct monetary loss. A “crypto compensation” lure abuses a legitimate-looking *Yandex* poll as an entry point, then redirects victims to a fake Bitcoin payout page claiming an approved `0.943 BTC` transaction and imposes a small “commission”/fee to withdraw funds—classic advance-fee fraud wrapped in a polished, multi-step funnel (including a fake chat “support agent”). Separately, Japanese-language phishing emails impersonating **ANA**, **DHL**, and **myTOKYOGAS** show consistent infrastructure patterns (notably `.cn` domains in sender and landing-page URLs), suggesting a single operator or shared kit targeting Japanese-speaking recipients. Several consumer scam advisories highlight **SMS-based fraud alerts** that push targets to call attacker-controlled phone numbers, where scammers pose as “support” to steal **Apple ID/2FA codes** or payment details, or to coerce victims into moving money. One PayPal-themed case escalated to cash withdrawals handed to a courier after a victim called a number from an unsolicited text, illustrating how “fraud department” pretexts can transition from phishing to **cash-out theft**. Additional warnings cover lookalike payment sites (e.g., `payyourbill.aps medical.com`) and generic guidance on what to do after clicking a phishing link; these are broadly consistent with the same theme (phishing/payment fraud) but are not tied to a single, specific campaign or actor across all items.
Jul 2, 2026
Researchers and industry reporting highlighted a sharp rise in **online scam infrastructure**, including a network of more than **20,000 fake shopping sites** built to steal payment data and personal information, and phishing campaigns that use **LiveChat-style customer support impersonation** to extract credit card details, PII, and even MFA codes. The fake-shop ecosystem uses polished storefronts, shared infrastructure, and rapid rebranding to mimic legitimate retailers at industrial scale, while the LiveChat campaigns begin with deceptive emails and move victims into real-time conversations with fake support agents posing as brands such as *Amazon* and *PayPal*. Separately, **Google, Meta, Amazon, and other companies** announced a voluntary intelligence-sharing pact to combat online scams across social media, marketplaces, messaging, and payments platforms. That agreement is related to the broader rise in fraud, but it is not about the same specific scam operations described in the threat reports. The combined reporting shows that scam activity is increasingly coordinated, multi-platform, and enabled by reusable infrastructure and social engineering techniques that make fraudulent interactions appear legitimate to victims.
Jun 29, 2026
Threat researchers reported multiple financially motivated social-engineering operations designed to steal credentials and enable downstream fraud. Malwarebytes documented a **job-themed phishing** campaign impersonating *Google Forms* via the lookalike domain `forms.google.ss-o[.]com`, using a `generation_form.php` script to generate personalized lure URLs and redirecting victims through a fake form to a credential-harvesting login flow (e.g., `id-v4[.]com`). The infrastructure also used redirection to local Google search pages as an anti-analysis tactic to reduce link sharing and researcher visibility. Separately, Bridewell-reported activity described a **Booking.com-themed, multi-stage phishing and fraud scheme** targeting both hotel partners and guests: initial “complaint”/reservation lures drive staff to attacker-controlled portals using lookalike domains (including **IDN homograph** tricks) to harvest partner credentials, followed by account takeover and guest-facing fraud (including WhatsApp outreach using real booking details). A third report described the broader rise of **Carding-as-a-Service (CaaS)** marketplaces (e.g., “fullz” bundling and platforms such as Findsome and UltimateShop) and the supply chain feeding them (PhaaS credential theft, skimming, and malware), but it did not describe the same specific phishing incidents and should be treated as related background rather than part of the same event.
Jun 29, 2026