Loading story…
League of Legends players are being targeted by a social-engineering campaign that sends friend requests through the Riot client immediately after matches, then uses flattering conversation to move victims onto Discord. Reports indicate the accounts are often throwaway or stolen and appear to be operated at scale with scripted or AI-assisted chat, recycled profile images, and consistent conversation patterns. Once contact shifts off-platform, the operators promote OnlyFans pages in some cases and, in others, deliver credential-harvesting or account-takeover links.
Community reporting suggests the targeting may be tied to visible post-match activity or third-party match-tracking data, although Riot has not confirmed the mechanism. Players have reported that enabling Riot privacy protections such as streamer mode can reduce unsolicited requests, and security guidance urges users to treat unknown post-match contacts as suspicious, avoid off-platform links, verify profile images with reverse-image search, and report abusive accounts to both Riot and Discord.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
League of Legends players reported receiving suspicious Riot client friend requests immediately after matches, often from accounts that did not match anyone in the just-finished game. The outreach used flattering messages, moved targets to Discord, and then promoted OnlyFans links or, in some variants, credential-harvesting or account-hijacking links.
Subsequent reporting described reused photos, scripted or AI-assisted conversations, and repeated personas claiming to be women seeking a duo partner, indicating the operation was being run at scale. Reports also noted that some accounts may be stolen and that enabling Riot client streamer mode appeared to reduce the frequency of the friend requests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Scammers are hijacking Reddit accounts by sending direct messages that falsely claim a user reported someone by mistake or was wrongly reported, then pressuring the target to help “fix” the issue. The attackers use fake Reddit-style emails, fabricated investigation screenshots, and referrals to supposed Reddit staff on Discord to create urgency and legitimacy, often adding countdowns or threats to push victims into acting quickly. The scheme relies on social engineering rather than malware or malicious links: victims are tricked into sharing real Reddit login or verification codes, allowing attackers to sign in, change passwords, and sometimes persuade users to switch the account email address to one controlled by the scammer. In some cases, the takeover is followed by extortion demands for gift cards or payment under threat of deletion or misuse of the account, while defenders recommend keeping verification codes private, enabling two-factor authentication, avoiding unofficial support contacts, and using Reddit’s official recovery channels if an account is compromised.
Jul 9, 2026
Criminals are using AI-generated deepfakes to impersonate real OnlyFans creators and defraud their followers, according to reports from Malwarebytes and Security Affairs. The scam commonly begins with fake videos or outreach on TikTok, then moves to direct conversations on Snapchat where the impersonator builds trust before requesting money through Cash App or similar payment channels. Victims who send funds are then blocked, while the real creators lose revenue and face backlash from followers who believed they were interacting with authentic accounts. Reported cases cited by Security Affairs include creators such as Jessieanna Campbell and Elaina St. James, whose likenesses were used in fraudulent schemes. Researchers said the fake content can sometimes be identified by artifacts such as distorted teeth, unnatural facial movement, or frozen eyebrows, but the impersonations are convincing enough to deceive fans. The reports add that legal measures including the **Take It Down Act** and the **EU AI Act** have not stopped the abuse, in part because enforcement remains difficult across borders, and they urge users to verify payment requests through creators’ official verified accounts.
Aug 7, 2026
A surge in **romance scams** is leveraging **AI-enabled impersonation** to make fraud harder to detect, combining manufactured intimacy with financial theft. Australian police warned more than 5,000 people they may have been targeted in a large-scale operation linked to overseas syndicates, where scammers used mainstream dating apps to initiate relationships and then steered victims into purchasing **fake cryptocurrency**. The playbook described includes rapidly escalating emotional commitment, isolating targets, and pushing conversations off-platform to apps like *WhatsApp* or *Telegram*, reducing victims’ access to in-app safety controls and reporting mechanisms. The fraud techniques increasingly rely on **deepfakes** and automated “AI personas,” undermining traditional verification methods such as requesting custom photos or relying on video calls as proof of identity. Reported tactics include real-time face-swapping and AI voice synthesis during video calls, long-running bot-driven conversations that build trust over months, and “celebrity” impersonation to intensify emotional leverage and extract larger payments. Despite the technology shift, the core mechanism remains psychological manipulation—using scripted narratives and social engineering to move victims from online rapport to off-platform communication and ultimately to financial transfers.
Jun 29, 2026