Loading story…
Scammers are hijacking Reddit accounts by sending direct messages that falsely claim a user reported someone by mistake or was wrongly reported, then pressuring the target to help “fix” the issue. The attackers use fake Reddit-style emails, fabricated investigation screenshots, and referrals to supposed Reddit staff on Discord to create urgency and legitimacy, often adding countdowns or threats to push victims into acting quickly.
The scheme relies on social engineering rather than malware or malicious links: victims are tricked into sharing real Reddit login or verification codes, allowing attackers to sign in, change passwords, and sometimes persuade users to switch the account email address to one controlled by the scammer. In some cases, the takeover is followed by extortion demands for gift cards or payment under threat of deletion or misuse of the account, while defenders recommend keeping verification codes private, enabling two-factor authentication, avoiding unofficial support contacts, and using Reddit’s official recovery channels if an account is compromised.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
In some cases, after taking over a Reddit account, scammers persuade victims to change the account email address to one controlled by the attacker. They then demand gift cards or payment while threatening account deletion or further abuse.
A scam emerged in which attackers contact Reddit users via direct messages and sometimes Discord, falsely claiming the victim reported someone by mistake or was wrongly reported. The attackers use fake Reddit-style emails, fabricated investigation notices, and urgency tactics to trick victims into sharing legitimate Reddit login or verification codes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TechCrunch warned that **scammers are impersonating TechCrunch reporters, editors, and event staff** to target companies with convincing “media inquiry” outreach designed to extract sensitive business information. The fraudsters leverage TechCrunch’s brand trust, mimic reporter writing styles, reference current startup trends, and request introductory calls; victims who participate in phone interviews report the impostors use the conversation to solicit additional proprietary details. The activity includes **spoofed identities of real staff** and evolving email tactics: some messages contain obvious address discrepancies, while newer attempts claim email address conventions that appear to match TechCrunch’s legitimate patterns, making verification harder. TechCrunch advised recipients to **verify purported staff identities via official staff listings and alternate contact methods** before sharing information, and noted the broader trend of criminals exploiting established media brands across the industry; SC Media amplified the warning and highlighted the risk of follow-on **account takeover and data theft** against sectors such as cryptocurrency and cloud/tech firms.
Jun 29, 2026
Multiple campaigns are abusing *legitimate* cloud and platform workflows to make phishing and fraud harder to detect. Attackers are generating real Apple and PayPal invoice/dispute emails and embedding scam phone numbers in user-controlled fields (e.g., “seller notes”), resulting in messages that carry valid **DKIM** signatures and originate from high-reputation domains; this “**DKIM replay**” style abuse bypasses many email controls because authentication validates the sender domain, not the safety of the embedded content. In parallel, threat actors are leveraging free **Google Firebase** developer accounts to host brand-mimicking phishing pages on trusted `firebaseapp.com` / `web.app` subdomains, increasing delivery and click-through rates by exploiting domain reputation and common allowlisting of Google infrastructure. A separate but related social-engineering technique targets **Telegram** users by manipulating Telegram’s official authentication workflows to obtain fully authorized sessions rather than simply stealing passwords. Victims are lured to Telegram-lookalike pages (often on ephemeral domains) that prompt QR scanning or phone-number entry; user interaction triggers a real login attempt initiated by the attacker, and once the victim approves the authorization prompt on their device, the attacker gains persistent account access and can pivot to follow-on attacks via the victim’s contacts. These incidents collectively highlight a shift toward “living off trusted services,” where adversaries avoid compromising vendors and instead weaponize legitimate features, trusted domains, and sanctioned authentication flows to reduce detection and increase victim compliance.
Jun 29, 2026
Multiple reports describe **social-engineering scams** that impersonate trusted brands and payment providers to drive victims into credential theft or direct monetary loss. A “crypto compensation” lure abuses a legitimate-looking *Yandex* poll as an entry point, then redirects victims to a fake Bitcoin payout page claiming an approved `0.943 BTC` transaction and imposes a small “commission”/fee to withdraw funds—classic advance-fee fraud wrapped in a polished, multi-step funnel (including a fake chat “support agent”). Separately, Japanese-language phishing emails impersonating **ANA**, **DHL**, and **myTOKYOGAS** show consistent infrastructure patterns (notably `.cn` domains in sender and landing-page URLs), suggesting a single operator or shared kit targeting Japanese-speaking recipients. Several consumer scam advisories highlight **SMS-based fraud alerts** that push targets to call attacker-controlled phone numbers, where scammers pose as “support” to steal **Apple ID/2FA codes** or payment details, or to coerce victims into moving money. One PayPal-themed case escalated to cash withdrawals handed to a courier after a victim called a number from an unsolicited text, illustrating how “fraud department” pretexts can transition from phishing to **cash-out theft**. Additional warnings cover lookalike payment sites (e.g., `payyourbill.aps medical.com`) and generic guidance on what to do after clicking a phishing link; these are broadly consistent with the same theme (phishing/payment fraud) but are not tied to a single, specific campaign or actor across all items.
Jul 2, 2026