Loading story…
Threat actors have operated a large-scale SMS phishing campaign impersonating T-Mobile, sending texts that falsely claim recipients' rewards points are about to expire. The messages create urgency with fabricated point balances and expiration dates, often use generic salutations, and direct targets to fraudulent point-redemption pages intended to collect credentials, personal information, payment details, or verification codes.
Active since early May, the operation produced more than 1,000 closely related message templates and used at least 81 short-lived domains over four months, predominantly following the pattern t-mobile.<random>.top. Users should not open links in unsolicited rewards messages and should verify account balances or offers only through T-Mobile's official website or mobile application.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Threat actors began a large SMS phishing campaign impersonating T-Mobile Rewards, falsely telling recipients that their rewards points were about to expire and directing them to fraudulent redemption pages. The operation used fabricated balances and expiry dates, generic salutations, and rotating lookalike domains.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 12 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Acronis researchers reported a deceptive Android campaign targeting Israeli users with a trojanized version of the *Red Alert* rocket-warning app distributed via SMS messages impersonating Israel’s Home Front Command. The fake app displays legitimate rocket alerts to reduce suspicion while requesting extensive permissions that enable **GPS tracking**, **SMS interception (including one-time passwords)**, contact harvesting, installed-app enumeration, and account discovery; collected data is exfiltrated to a remote server, and the operators used **certificate spoofing** to make the installation appear as if it came from Google Play. Separate consumer-focused advisories described multiple **social-engineering/phishing** lures delivered via text, email, and calendar invites: an “Amazon recall” SMS that pushes victims to a credential-harvesting site for “refunds,” an “Apple Security Alert” pop-up/text/email that attempts to drive victims to call a fraudulent support number or surrender credentials/2FA/payment details, and a trend of **fake calendar invitations** increasingly appearing in Microsoft Outlook (previously more common in Gmail) using urgent subjects (e.g., “Final Notice”) and domain-reconnaissance to personalize invites; the Outlook example noted mixed authentication signals (DMARC/SPF/DKIM pass/fail across relays), underscoring that users and defenders should treat unsolicited invites and urgent account/payment prompts as high-risk even when messages appear superficially legitimate.
Jun 29, 2026
Recent research highlighted systemic security and privacy risks created by **sign-in/authentication links delivered over SMS**, showing how easily such links and embedded personal data can be exposed and abused at scale. By observing public SMS gateway services (temporary numbers used to receive texts), researchers collected **332,000 unique SMS-delivered URLs** extracted from **33 million texts** sent to **30,000+ phone numbers**, and reported that messages from **701 endpoints** on behalf of **177 services** exposed *critical PII*. The work underscores that SMS is unencrypted and that authentication links and sensitive details can persist in accessible stores or be captured through weakly protected SMS delivery ecosystems. Greek police separately dismantled a criminal operation in the Athens area that used a **rogue mobile base station** (an “**SMS blaster**”) concealed in a car to push phishing texts to nearby phones. Authorities said the device coerced phones to connect and **downgraded them from 4G to 2G**, enabling collection of identifiers (e.g., phone numbers) and delivery of scam messages impersonating banks and courier firms with **phishing links** used to steal payment card data and conduct unauthorized transactions; investigators have tied the group to at least three fraud cases and indicated the suspects may be Chinese nationals. Together, the reporting and research illustrate how SMS-delivered links can be exploited both through passive exposure of messages/URLs and through active, proximity-based telecom impersonation to distribute credential- and payment-theft lures.
Jun 29, 2026
Security researchers reported coordinated phishing campaigns targeting customers of multiple Indian banks through SMS lures that redirected victims to spoofed banking and rewards pages or pushed malicious Android app downloads. Trend Micro said the activity targeted customers of **seven banks** and used several malware families, including **Elibomi**, **FakeReward**, **AxBanker**, **IcRAT**, and **IcSpy**, while Microsoft separately detailed a **Rewards Plus** cluster that impersonated mobile banking rewards programs to deliver an information-stealing remote access trojan. McAfee also documented related phishing malware aimed at Indian taxpayers, showing broader abuse of social-engineering themes tied to financial services and government processes. The Android malware abused **Accessibility** services and other permissions to seize extensive control of infected devices, including capturing screenshots, unlocking phones, disabling protections, intercepting SMS messages and notifications, and exfiltrating personal, banking, and payment-card data to remote servers. Researchers said the operators relied on short-lived phishing domains, fake overlays, and reward-themed branding to evade detection and increase installs, creating a pathway for account takeover, credential theft, and fraudulent banking transactions affecting potentially millions of customers.
Aug 15, 2026