phishing

A user received a random verification email from Cheddar.tv and is concerned about whether it is phishing. They noted that they do not use Cheddar.tv for news and did not recently create an account, making the source of the email confusing. Despite their suspicion, the email address seems reasonable to be genuine.

Hardware wallet firms are warning about a surge in phishing attacks targeting Coldcard users, with fake 'coordinated hardware audit' emails directing victims to a cloned Coldcard site that installs remote-access software. Losses from these attacks are nearing $130 million.

A WhatsApp scam tricks users into clicking fake voting links to steal account access via the 'Linked devices' feature. The scam leverages trust in known contacts by asking victims to support a friend or relative in an online contest, redirecting them to a phishing page that mimics WhatsApp's authentication process.

A GoPuff user reports receiving suspicious texts and app notifications about FAM Membership payment issues, despite confirming their Apple Pay method is valid. The user suspects a scam due to the messages' urgency and similarity to legitimate notifications, but has not found widespread reports of the issue.

A Reddit user received a DM from a scammer claiming their account was compromised and urging them to contact 'Reddit Support' via Discord, which is not an official channel. The user became suspicious after verifying Reddit's support policies and took precautions like changing their password and blocking the account.

Fake Fortnite reward websites trick players into entering their Epic Games login details, leading to account theft. These scams promise free V-Bucks, cash, or locker value calculations but are designed to steal credentials. Stolen accounts can be sold, used to scam friends, or exploited for financial gain, targeting Fortnite's large player base and younger demographics vulnerable to phishing.

A user in Ireland clicked a phishing link after receiving a text claiming to be from the postal service, which asked for payment of an online import tax. The fake website resembled the official postal service site, but the user stopped before submitting personal details after verifying the postal service does not request tax payments via text. The user is now concerned about potential malware on their iPhone 8.

Over 120 fake Walmart websites are scamming users by offering deep discounts on liquor and prompting credit card details at checkout. These sites use identical templates and borrowed trust from Walmart's brand to steal financial information.

A user reports receiving phishing texts about parking payment defaults from unknown numbers, seeking confirmation if it is a scam and advice to reduce phishing messages. The text includes instructions to click a link and enter a vehicle registration number, despite the user not owning a car.

A new eBay seller was scammed by a buyer who sent a fake payment confirmation with a QR code leading to a phishing site, resulting in an unauthorized debit card charge. The buyer's account was suspended, and the item was never sold. The seller is seeking advice on recovery options through eBay or the bank.

A UK user received a suspicious email appearing to be from their sister, clicked a link leading to an unfamiliar news site, and is concerned about potential security risks. They confirmed not entering personal information, are using an iPhone, and are unsure if Apple's security measures protect them from phishing attempts.

A person received a call from an unknown middle-aged woman discussing a boy who drowned, leading them to hang up due to fears of a scam. The caller's professional-sounding voice raised concerns about phishing or a water safety campaign.

The user reports frequent phishing attempts via text from Cash App and Venmo, including 6-digit codes sent every 12-18 hours, raising concerns about account takeover risks. They have already implemented a 4-digit passcode for Venmo but lack a Cash App account, highlighting ongoing struggles with spam and unauthorized access attempts.

A user received a convincing phishing call from someone claiming to be from Wells Fargo's fraud department, who alleged a credit card was opened in their name in Toronto Canada. After transferring to a supervisor who mentioned DHS involvement, the user contacted Wells Fargo directly, but the bank found no evidence of the claimed activity.

A user received an email claiming an order was ready for pickup via DoorDash, despite not having an account. The order details were suspiciously vague, including a location in Australia and a minimal cost of 0.50 AUD with no item description. The user questions whether this is a typo, phishing attempt, or scam.

The user received two suspicious emails with similar messages and links. The first email was clicked but closed, then blocked, while the second email had a different address but a similar request. The user is concerned about potential security risks.

A Bank of America customer received a fraudulent text alerting them to a $218.40 purchase at a distant Target store. After calling the provided number and realizing it was a phishing scam, they hung up and verified the transaction using the card's official contact method.

A Reddit user received a message from an unknown individual claiming they were mistakenly reported for spamming phishing links. The sender provided a screenshot of an email allegedly from Reddit's team, urging an appeal within 12 hours to avoid account suspension. The user expresses suspicion due to lack of official notifications and the sender's hidden history.

A user reports receiving four suspicious emails from 'Alana Michalova' via a Gevo email address, falsely claiming Microsoft would deactivate their account unless they validated it. The user highlights inconsistencies, such as the sender not being Microsoft and repeated 'last warning' messages, and advises against clicking the provided link.

A user is receiving suspicious emails from Zoom claiming someone named Jimi Gibson is sharing clips, linked to a company called Clearview Cleaning. Recent emails show variations in the sender's email address and company description, raising concerns about a potential phishing scam.

PayPal refunded $1,185 stolen through unauthorized transactions after a user likely clicked a phishing link. The user has since strengthened account security by changing passwords, enabling 2FA, and reviewing access, while warning others to prioritize security for PayPal accounts.

There has been a notable increase in scam calls from 'processing companies' urging recipients to call numbers on caller IDs. Examples include claims about document deliveries requiring signatures and alphanumeric codes. The article questions if these calls correlate with credit card (CC) leaks or another cause.

A user reported receiving phishing emails, including one spoofed from their own email address, and noticed random unsent emails in their sent folder despite no malicious login attempts and multiple password changes.

A user received an unexpected email in Spanish from Shopify about setting up a dropshipping store, despite never having created a Shopify account. The email's content and lack of account activity raise concerns about potential phishing or unauthorized use of their email address.

A fake flyer claiming to offer free athletic shoes from the VA is circulating, using official VA-style branding and a legitimate MyVA phone number to deceive veterans. The VA confirms the offer is fraudulent and warns it could lead to phishing attempts or theft of personal information.

A Reddit user reported a phishing attempt where an account claimed to have been scammed by an impersonator using a Reddit support image with a Discord username. The scammer pressured the user to move to a third-party client, prompting the user to report the incident and verify their account's security.

A user received a phishing text from scammers claiming to be FedEx after their father ordered a package from Darvil Supply using Shop Pay with their phone number. The user clicked a 'Verify you’re human' checkbox but closed the link after Safari flagged it as deceptive, raising concerns about potential data leaks or device compromise.

A caller claiming to be from the National Processing Center called the user and their mother, stating their names and county, and mentioned a 'servicer processer delivery' scheduled for Monday. The user questions if this is a phishing scam, as the number provided no results when searched.

A suspicious job offer involves a developer requesting help with client communication and project planning, offering high weekly compensation. The scammer claims to handle account setup on freelance platforms and development work, with the victim attending meetings and receiving 15% of project revenue. Concerns focus on phishing or more elaborate schemes.

Attackers are exploiting AI-generated fake domains by purchasing them and hosting phishing pages or malware, a tactic named 'phantom squatting' by Palo Alto Networks' Unit 42. The practice leverages domains hallucinated by large language models to direct traffic to malicious sites.

Scammers are targeting individuals with Japanese phone numbers via WhatsApp, sending phishing messages that mimic Facebook communications. The scammer's access to the victim's phone number suggests a potential data leak on WhatsApp, as they use business accounts to appear legitimate.

An Australian user on Vinted received a suspicious purchase confirmation email from a buyer, directing them to a non-Vinted website (Vinted.rethreadco.com) to enter card details. The user is concerned as the transaction isn't reflected in the app, the purchaser's name doesn't match the email, and they question if this is a scam.

A user received a suspicious Discord friend request from the Wuthering Waves Official Discord, leading to a voice call with a person claiming to be German but speaking Turkish with unnatural vocal glitches. The individual requested feedback on a Minecraft server link with a newly registered domain (May 5, 2026) and defensively dismissed concerns about its legitimacy.

A Reddit user received a direct message alleging a phishing attack and was instructed to contact Reddit's legal department on Discord. The user shared a screenshot of an email with a Reddit letterhead and later questioned if the situation was a scam after following the instructions.

A phishing email with a malicious JavaScript file disguised as a PDF installs a Chrome extension that steals session cookies and uses Chrome Native Messaging to execute PowerShell commands. The malware bypasses multi-factor authentication by hijacking active browser sessions and collects data like open tabs and system files.

A user's main Google account is being spammed with 4-5 phishing emails per minute, including auto-responses and references to 'rediffmailpro.com'. The user is seeking solutions to stop the spam and understand its purpose.

Fake subscription renewal notices impersonating Malwarebytes and other companies are being used in phishing and tech support fraud scams. These emails often include fabricated details, high charges, and fake contact information to trick recipients into divulging personal or financial information.

A user received a phishing email appearing to be from their state's DMV, containing a malicious link and an attached renewal registration PDF with their personal and vehicle information. The registration was not due for three months, raising concerns about the public availability of such data.

A user receives frequent phishing emails claiming their Cloud+ subscription payment failed, risking data deletion. They report marking emails as spam and blocking senders, but the messages persist with varying sender addresses.

INTERPOL has reported a 'dramatic increase' in cybercrime across Asia and the South Pacific, driven by digitalization, internet expansion, new technologies, organized criminal networks, and uneven cybersecurity readiness. Phishing is highlighted as the most widespread threat in the region.