Threat reportPhishingTL-2026-1674
Call of Duty Mobile 'Free Points' Phishing Scam Uses Real-Time Credential Relay to Hijack Activision Accounts
Call of Duty Mobile 'Free Points' Phishing Scam Uses (TL-2026-1674), also tracked as CoD Mobile Free Points Scam, is a medium-severity phishing campaign, first published 2026-07-24. It has no confirmed attribution, affects Activision Call of Duty Mobile player accounts / Activision account, maps to 15 MITRE ATT&CK techniques (T1036, T1056, T1078), and is covered by 9 detection rules and 15 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-1674
- Threat ID
- TL-2026-1674
- Also known as
- CoD Mobile Free Points Scam, Call of Duty Mobile Fake Free Points Phishing
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- gaming, consumer, entertainment
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in Call of Duty Mobile 'Free Points' Phishing Scam Uses
Malware and tooling: Malwarebytes Browser Guard, Malwarebytes Scam Guard
How Call of Duty Mobile 'Free Points' Phishing Scam Uses works
A phishing campaign impersonates the official Call of Duty Mobile site, luring players with an offer of 10,800 free points in exchange for their email and password. The phishing kit relays stolen credentials in real time to the genuine Activision login page, triggers legitimate 2FA, then captures the resulting 2FA code on a second page before it expires, giving attackers full account access.
Malwarebytes Threat Intel identified an active phishing campaign targeting Call of Duty Mobile players that abandons the classic 'enter a redemption code' lure in favor of a full account-takeover flow built around adversary-in-the-middle (AiTM) credential relay. The fake site copies the visual style of the official Call of Duty Mobile promotions page and offers 10,800 free CoD Points, but instead of a redemption code it asks the victim to log in with their full Activision email address and password. Rather than simply harvesting these credentials for later reuse, the phishing kit immediately forwards them in real time to the genuine Activision authentication endpoint. Because the submitted credentials are valid, Activision's own backend responds with a legitimate two-factor authentication (2FA) challenge. The phishing kit then presents the victim with a second fake page asking them to enter that one-time code, captures it before it expires, and relays it to the real login flow to complete authentication -- giving the attacker a fully authenticated session without ever needing to defeat 2FA cryptographically. The kit contains multiple quality-control tells that a careful user could catch: a malformed call-to-action reading 'GET FREE POINT' (missing the plural), awkward phrasing in the instructions, an embedded live-chat widget included purely to look legitimate, and a false claim that the reward will be 'confirmed' within four to eight hours, which both manufactures urgency and buys the operators a window before the victim expects a payout that never arrives. The financial incentive for attackers is significant: Call of Duty Mobile has been downloaded an estimated 489 million times and has generated roughly $1.8 billion in lifetime in-app purchases. A compromised Activision account exposes stored payment methods, purchase history, and -- because Activision accounts are frequently linked to Xbox, PlayStation, and Battle.net identities -- provides a pivot point into a victim's broader cross-platform gaming and payment ecosystem. Malwarebytes did not disclose the phishing domain, hosting infrastructure, or file-based indicators for this specific campaign; the advisory instead documents the technique and recommends URL verification, ignoring countdown-style urgency cues, only claiming promotions through official in-app or self-navigated channels, and use of Malwarebytes Scam Guard and Browser Guard for real-time detection. The credential-relay-plus-2FA-capture pattern described mirrors the mechanics of commodity adversary-in-the-middle phishing-as-a-service kits (e.g., Tycoon 2FA, EvilProxy, Evilginx2-derived proxies) that have driven large-scale MFA-bypass campaigns across other sectors; no specific kit attribution was made for this campaign.
MITRE ATT&CK techniques used in TL-2026-1674
Defense Evasion
Collection
stealth
command-and-control
Credential Access
T1111 Multi-Factor Authentication Interception; T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
execution
Lateral Movement
T1550 Use Alternate Authentication Material
Initial Access
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1608 Stage Capabilities
Reconnaissance
T1593 Search Open Websites/Domains
Impact
Affected products and versions in Call of Duty Mobile 'Free Points' Phishing Scam Uses
- Activision — Call of Duty Mobile player accounts / Activision account platform
Vulnerable versions: all Activision accounts used for Call of Duty Mobile - Activision — Linked cross-platform gaming accounts (Xbox, PlayStation, Battle.net) and stored payment methods
Vulnerable versions: accounts linked to a compromised Activision login
Remediation for Call of Duty Mobile 'Free Points' Phishing Scam Uses
Immediate actions
- Warn player communities and community managers that any 'free CoD Points' offer requiring full account login (rather than a code redeemed in-app) is fraudulent
- Report and request takedown of impersonating Call of Duty Mobile promotion pages via brand-protection/anti-phishing channels
- Advise users who entered credentials and a 2FA code on such a site to immediately change their Activision password and any reused passwords, and to review linked Xbox/PlayStation/Battle.net accounts and payment methods for unauthorized activity
Workarounds
- Only redeem in-game currency promotions through the official Call of Duty Mobile app or by manually navigating to activision.com rather than following links from ads, forums, or social media
- Ignore countdown timers and 'confirmation window' claims on promotional pages -- these are designed to suppress scrutiny
- Treat any request to re-enter a 2FA/OTP code on a second, unfamiliar page as an active account-takeover attempt and abort the login
Longer-term hardening
- Encourage adoption of phishing-resistant authentication (FIDO2/passkeys/hardware security keys) for gaming and platform accounts, which are not susceptible to OTP-relay AiTM capture
- Deploy browser-based anti-phishing/heuristic tooling (e.g., Malwarebytes Browser Guard-class products) that flags credential-input forms on suspicious or newly-registered domains
- Educate players via in-app messaging that Activision/Call of Duty will never require a full account login through a third-party promotional page
Timeline of Call of Duty Mobile 'Free Points' Phishing Scam Uses
- Malwarebytes publishes public advisory documenting the scam's red flags and recommending Scam Guard/Browser Guard plus manual URL verification.
- Attacker-controlled account exposes stored payment methods, purchase history, and linked Xbox/PlayStation/Battle.net identities.
- The captured 2FA code is relayed to the real Activision login flow, completing authentication and giving the attacker full control of the account.
- A second phishing page prompts the victim for the 2FA code and captures it before it expires.
- Because the relayed credentials are valid, Activision's authentication backend issues a legitimate two-factor authentication challenge to the victim.
- The phishing kit immediately relays the submitted credentials in real time to the genuine Activision login page (adversary-in-the-middle proxy).
- Victim submits their full Activision email address and password into the fake login form instead of a redemption code.
- Victim is directed to a fake Call of Duty Mobile site offering 10,800 free CoD Points in exchange for logging in with their Activision email and password.
- Malwarebytes Threat Intel identifies and analyzes an active phishing campaign impersonating the Call of Duty Mobile free-points promotion.
Sources cited for Call of Duty Mobile 'Free Points' Phishing Scam Uses
- Call of Duty Mobile scam uses fake free points to steal player accounts
- Tycoon 2FA: How This PhaaS Kit Bypasses MFA at Scale
- Unmasking Sneaky 2FA: How Modern Phishing Kits Bypass MFA in 2026
- Astaroth Phishing Kit Bypasses 2FA Using Reverse Proxy Techniques
- AitM Phishing: How Attackers Bypass MFA and How to Stop Them
- How Hackers Bypass MFA Using Real-Time Phishing Kits
- Malwarebytes Scam Guard Prevented High-Risk Fraud in 15% of Interactions
- Scam Guard for desktop: A second set of eyes for suspicious moments
Detection coverage for TL-2026-1674
As of 2026-07-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1674 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.