Loading story…
A phishing campaign is targeting Call of Duty Mobile players with a fake free Call of Duty Points giveaway page that impersonates an official promotion and steals account credentials. The fraudulent site prompts victims to enter their email address and password, then sends them to a second page to capture a one-time two-factor authentication code. Researchers said the operation uses real-time credential relay against Activision’s legitimate login flow, allowing attackers to intercept the 2FA code before it expires and take over the account.
The scam has no connection to Activision and is designed to seize access to player accounts that may also be linked to Xbox, PlayStation, or Battle.net profiles. Because those accounts can store payment details and broader gaming identities, a successful compromise can expose more than in-game currency. Affected users were urged to change their Activision password immediately, review account activity, sign out of active sessions, and check saved payment methods for unauthorized charges.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Researchers reported a phishing campaign impersonating an official free Call of Duty Points giveaway page to steal Call of Duty Mobile players’ Activision credentials and one-time 2FA codes, enabling account takeover. The scam used real-time credential relay against Activision’s legitimate login flow and was described as having no connection to Activision.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A phishing campaign abused Microsoft's OAuth 2.0 **Device Authorization Grant** (`Device Code Flow`) to capture valid Microsoft account tokens without sending victims to a counterfeit login page. Victims received emails posing as legal notifications, including password-protected PDF attachments, and were funneled through phishing pages that displayed a one-time device code before directing them to the legitimate `microsoft.com/devicelogin` page. After victims entered the code and completed normal MFA on Microsoft's real site, the attackers obtained `access_token`, `refresh_token`, and `id_token` values tied to attacker-controlled applications. The stolen tokens enabled persistent access to Microsoft services including **email, OneDrive, and Teams**, allowing attackers to read messages, access files, and monitor conversations. Researchers said the activity was observed from early April to mid-May 2026 and included a Brazil-focused variant that used legitimate redirect links, including on **cacoo.com**, to add credibility to the lure chain. Defenders were urged to reject unexpected device authorization prompts, inspect redirect parameters in otherwise legitimate URLs, disable Device Code Flow in Microsoft Entra ID where it is not needed, and monitor **DeviceCodeSignIn** and anomalous sign-in activity for signs of compromise.
Jul 9, 2026
Microsoft disclosed a large-scale phishing campaign that targeted more than **35,000 users** at over **13,000 organizations** across **26 countries**, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals. Microsoft said the attackers used an **adversary-in-the-middle** phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as **Tycoon 2FA**, **Kratos**, and **EvilTokens**. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Jun 29, 2026
A large-scale credential phishing operation impersonated **Amazon Japan** and sent hundreds of thousands to more than one million messages per day, using Japanese-language lures about account ownership, payment updates, and account locks to drive victims to spoofed login pages. The campaign harvested **credentials, personally identifiable information, and payment card data**, and initially used geofencing so users in Japan saw the fake pages while users elsewhere were redirected to the legitimate Amazon Japan site. Researchers linked the activity through reused infrastructure including IP-based landing pages and `.xyz` and `.cn` domains, with the scale and persistence suggesting possible botnet-driven delivery. Separately, Facebook disclosed legal action against an account takeover scheme in which attackers posed a malicious Android app, **"Ad Manager for Facebook,"** as a legitimate tool for advertising and marketing agency staff. The app stole credentials and enabled session or cookie hijacking, allowing the operators to seize Facebook accounts and run unauthorized advertisements, including scam promotions, causing losses reported at more than **$16 million** and previously described as over **$36 million** in unauthorized ads. Facebook said it removed the app from Google Play and other sources, refunded affected victims, and worked to secure compromised accounts.
Aug 15, 2026