# Malwarebytes Subscription Renewal Scam — Fake-Invoice / Refund-Bait Callback Phishing Campaign ("Account Maintenance Update")

> An active brand-impersonation scam emails fraudulent Malwarebytes subscription-renewal invoices (subject "Account Maintenance Update", $276.50 for a fictitious "Ultimate Security Pack") that pressure recipients to call +1 (810) 210-5434 or click a dispute link. The callback funnels victims into a tech-support / refund-bait scam toward payment fraud, credential theft, and remote-access abuse; sibling variants impersonate PayPal, Amazon, and Geek Squad.

- **Published:** 2026-06-24T00:00:00Z
- **Last reviewed:** 2026-06-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0936
- **ID:** TL-2026-0936
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Malwarebytes Labs documented an active subscription-renewal scam in which threat actors impersonate Malwarebytes to deliver fraudulent invoice emails. The lure email carries the subject line "Account Maintenance Update" and contains official-looking but entirely fabricated billing artifacts: invoice reference INV-ZIDNQCWSMO, activation code 8fd14ea8-4014-4430-ba19-313554098112, a charge of $276.50 USD, and a made-up product "Ultimate Security Pack" with a "3 Years, 3 Devices" license term. The charge is deliberately large enough to provoke alarm, and the message ends with a callback number (+1 (810) 210-5434) or a "dispute the charge" link, steering the recipient away from legitimate billing channels.

The campaign is a classic callback-phishing / TOAD (telephone-oriented attack delivery) operation. Because the email frequently carries no malicious attachment or link, it evades content-scanning controls and relies entirely on social engineering. Senders use compromised mailboxes or lookalike domains so the sender address does not belong to the company being impersonated. Once a victim calls, the actor escalates through a standard tech-support-scam playbook: requesting remote-access software to the victim's machine, directing the victim to log into online banking, processing a fake refund through a spoofed website that harvests card/banking credentials, then claiming an "over-refund" was issued and demanding repayment via gift cards, cryptocurrency, wire transfer, or payment apps. Some variants pivot the impersonated brand to PayPal or other payment providers and direct victims to phishing sites that steal banking credentials.

This activity sits inside a broader refund-bait ecosystem reported by Malwarebytes in 2026. A March 2026 variant abused Google/Outlook calendar invites to plant fake Malwarebytes renewal notices, using callback numbers in the 810 (Michigan) and 865 (Tennessee) area codes — the same 810 prefix as this campaign's +1 (810) 210-5434, indicating a shared or co-located scam-call infrastructure cluster. A June 2026 Malwarebytes investigation caught a fake-invoice kit mid-construction (templates still contained unfilled placeholders #TFN#, #PRICE#, #DATE#, #EMAIL#) impersonating PayPal, Amazon, and Geek Squad, staged on a family of throwaway .xyz "invoice" domains (invoicepdfin.xyz, invoicepdfus.xyz, invoicepdfusa.xyz, invoicerep.xyz, invoicestatement.xyz, invoicestm.xyz) with callback numbers 804-392-2793 and 801-640-8589 and charge amounts such as $349, $499, and $598.96. This is not a software vulnerability and carries no CVE; it is an active, financially motivated social-engineering campaign with extractable indicators that warrant defender awareness, user-reporting workflows, and SOC blocklisting of the callback numbers and staging domains.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1598.003 Spearphishing Link
- T1598.004 Spearphishing Voice
- T1589 Gather Victim Identity Information
- T1589.002 Email Addresses
- T1583 Acquire Infrastructure
- T1583.001 Domains
- T1583.004 Server
- T1586.002 Email Accounts
- T1608.001 Upload Malware
- T1566 Phishing
- T1566.002 Spearphishing Link
- T1566.004 Spearphishing Voice
- T1204 User Execution
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1219 Remote Access Tools
- T1056 Input Capture
- T1657 Financial Theft

## Sources

- [Watch out for renewal scams pretending to be Malwarebytes](https://www.malwarebytes.com/blog/scams/2026/06/watch-out-for-renewal-scams-pretending-to-be-malwarebytes)
- [We found this fake-invoice campaign while scammers were still building it](https://www.malwarebytes.com/blog/threat-intel/2026/06/we-found-this-fake-invoice-campaign-while-scammers-were-still-building-it)
- [Watch out for fake Malwarebytes renewal notices in your calendar](https://www.malwarebytes.com/blog/threat-intel/2026/03/fake-malwarebytes-renewal-notices-in-your-calendar)
- [Watch out for renewal scams pretending to be Malwarebytes (syndication)](https://securityboulevard.com/2026/06/watch-out-for-renewal-scams-pretending-to-be-malwarebytes/)
- [Verify subscription renewal email is legitimate — Malwarebytes Help Center](https://support.malwarebytes.com/hc/en-us/articles/360039025053-Verify-subscription-renewal-email-is-legitimate)
- [How To Spot, Avoid, and Report Tech Support Scams — FTC Consumer Advice](https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams)
- [How to recognize a fake Geek Squad renewal scam — FTC Consumer Advice](https://consumer.ftc.gov/consumer-alerts/2022/10/how-recognize-fake-geek-squad-renewal-scam)
- [Scammers Abuse Calendar Invites to Plant Phony Subscription Notices — KnowBe4](https://blog.knowbe4.com/scammers-abuse-calendar-invites-to-plant-phony-subscription-notices)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0936