Loading story…
Scammers are targeting fans seeking Céline Dion Paris concert tickets through Facebook groups, Marketplace listings, and spoofed ticketing websites that impersonate Ticketmaster, AXS, Céline Dion’s official site, and the Paris venue. Researchers reported that the operation uses social engineering, urgency, and scarcity to pressure buyers into quick purchases, often steering them toward direct bank transfers or fraudulent checkout pages hosted with Shopify components.
One tactic involves sending a legitimate Ticketmaster digital transfer to a buyer while reselling the same ticket and entry code to multiple victims, ensuring that only the first person scanned at the venue gains entry. Investigators also linked the campaign to a recycled scam kit and a broad set of suspicious domains and URLs used for brand impersonation and payment abuse, and published detection queries to help defenders monitor related activity.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
The threat research report published a large set of malicious or suspicious domains and URLs associated with the fake ticket operation. It also included detection queries intended to help defenders monitor related activity.
Threat researchers reported an online fraud campaign targeting fans seeking tickets for Céline Dion's 2026 Paris concerts. The campaign uses Facebook groups and Marketplace listings, repeated resale of the same Ticketmaster transfer ticket, and spoofed ticketing websites impersonating Ticketmaster, AXS, the artist, and the venue.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 60 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcehackread.com
Open sourcecommunity.gurucul.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple consumer-facing fraud campaigns are circulating that use **fake online stores**, **impersonation**, and **social-media marketplace deception** to steal money and potentially harvest personal/financial data. One campaign uses “**That’s my shit**” as a recurring phrase/branding for fraudulent storefronts that copy legitimate creators’ images and videos to sell counterfeit or non-existent merchandise; victims report non-delivery, low-quality goods, or exposure of personal and payment information during checkout. Separately, a phishing-style email scam impersonates **Kroll** by referencing class-action settlements and crypto/FTX themes to entice recipients to engage; the message appears to be sent via a legitimate email-sending infrastructure (notably a Shopify-associated domain with passing SPF/DKIM/DMARC), illustrating how attackers can abuse reputable platforms/domains to increase credibility. Another active scam targets would-be pet buyers through fake “**Cats of Albany**” Facebook groups/ads, pushing victims to pay deposits via **PayPal Friends and Family** (no buyer protection) for kittens that do not exist, then escalating fees (shipping/insurance/crates) before disappearing.
Jun 29, 2026
Threat actors are scaling **impersonation-driven fraud** by abusing trust signals—public figures, brands, and platform distribution—to lure victims into handing over money or sensitive information. One documented operation used **celebrity impersonation** tailored to Canadians, selecting locally relevant public figures and using **social media ad targeting** (e.g., geolocation and profile-based targeting) to constrain exposure to the intended country and increase conversion; the campaign also leveraged emotionally manipulative narratives (e.g., injury/misfortune) to accelerate engagement and reduce skepticism. In parallel, **domain-based impersonation (“digital squatting”)** has increased materially, with reporting citing a **68% rise** over five years and **WIPO** recording **6,200 domain disputes in 2025**. Common techniques include `typosquatting`, `combosquatting`, `TLD squatting`, and `homograph` attacks, which route users to phishing or fraudulent payment pages that mimic legitimate brands; the trend is also driving reputational harm when victims receive low-quality or nonexistent services. Recommended mitigations emphasized in reporting include proactively registering defensive domains across multiple TLDs and monitoring for lookalike domains to reduce brand impersonation risk.
Jun 29, 2026
Multiple brand-impersonation scams are targeting consumers by pushing them to interact with **fake customer support** and surrender sensitive data. One campaign uses a fraudulent site styled as **Avast** to convince French-speaking users they were charged **€499.99** and must act quickly to “cancel” and receive a refund; the page dynamically inserts the current date via JavaScript, loads the Avast logo from Avast’s own CDN to appear legitimate, and then harvests full payment-card details (PAN, expiry, and CVV) via a cancellation/refund form. Separate but related social-engineering activity targets **Robinhood** users with “security alert” **SMS** and **email** lures that direct victims to call scam call-center numbers, where operators attempt to extract login credentials, 2FA codes, and other personal/financial information; the email variant also commonly pushes victims toward installing remote-access tools such as *AnyDesk* or *TeamViewer* under the guise of support. In another consumer fraud pattern, scammers posing as a mobile carrier (e.g., **Spectrum**) call shortly after a phone delivery, claim the wrong device was shipped, and trick the recipient into mailing the phone to the attacker—enabling resale and potential identity-fraud follow-on if the device/line is activated under the victim’s details.
Jul 2, 2026