# Call of Duty Mobile 'Free Points' Phishing Scam Uses Real-Time Credential Relay to Hijack Activision Accounts

> A phishing campaign impersonates the official Call of Duty Mobile site, luring players with an offer of 10,800 free points in exchange for their email and password. The phishing kit relays stolen credentials in real time to the genuine Activision login page, triggers legitimate 2FA, then captures the resulting 2FA code on a second page before it expires, giving attackers full account access.

- **Published:** 2026-07-24T00:00:00Z
- **Last reviewed:** 2026-07-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1674
- **ID:** TL-2026-1674
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Malwarebytes Threat Intel identified an active phishing campaign targeting Call of Duty Mobile players that abandons the classic 'enter a redemption code' lure in favor of a full account-takeover flow built around adversary-in-the-middle (AiTM) credential relay. The fake site copies the visual style of the official Call of Duty Mobile promotions page and offers 10,800 free CoD Points, but instead of a redemption code it asks the victim to log in with their full Activision email address and password. Rather than simply harvesting these credentials for later reuse, the phishing kit immediately forwards them in real time to the genuine Activision authentication endpoint. Because the submitted credentials are valid, Activision's own backend responds with a legitimate two-factor authentication (2FA) challenge. The phishing kit then presents the victim with a second fake page asking them to enter that one-time code, captures it before it expires, and relays it to the real login flow to complete authentication -- giving the attacker a fully authenticated session without ever needing to defeat 2FA cryptographically. The kit contains multiple quality-control tells that a careful user could catch: a malformed call-to-action reading 'GET FREE POINT' (missing the plural), awkward phrasing in the instructions, an embedded live-chat widget included purely to look legitimate, and a false claim that the reward will be 'confirmed' within four to eight hours, which both manufactures urgency and buys the operators a window before the victim expects a payout that never arrives. The financial incentive for attackers is significant: Call of Duty Mobile has been downloaded an estimated 489 million times and has generated roughly $1.8 billion in lifetime in-app purchases. A compromised Activision account exposes stored payment methods, purchase history, and -- because Activision accounts are frequently linked to Xbox, PlayStation, and Battle.net identities -- provides a pivot point into a victim's broader cross-platform gaming and payment ecosystem. Malwarebytes did not disclose the phishing domain, hosting infrastructure, or file-based indicators for this specific campaign; the advisory instead documents the technique and recommends URL verification, ignoring countdown-style urgency cues, only claiming promotions through official in-app or self-navigated channels, and use of Malwarebytes Scam Guard and Browser Guard for real-time detection. The credential-relay-plus-2FA-capture pattern described mirrors the mechanics of commodity adversary-in-the-middle phishing-as-a-service kits (e.g., Tycoon 2FA, EvilProxy, Evilginx2-derived proxies) that have driven large-scale MFA-bypass campaigns across other sectors; no specific kit attribution was made for this campaign.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1585 Establish Accounts
- T1566 Phishing
- T1204 User Execution
- T1036 Masquerading
- T1090 Proxy
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1078 Valid Accounts
- T1056 Input Capture
- T1550 Use Alternate Authentication Material
- T1657 Financial Theft

## Sources

- [Call of Duty Mobile scam uses fake free points to steal player accounts](https://www.malwarebytes.com/blog/threat-intel/2026/07/call-of-duty-mobile-scam-uses-fake-free-points-to-steal-player-accounts)
- [Tycoon 2FA: How This PhaaS Kit Bypasses MFA at Scale](https://www.group-ib.com/masked-actors/tycoon2fa/)
- [Unmasking Sneaky 2FA: How Modern Phishing Kits Bypass MFA in 2026](https://threatlabsnews.xcitium.com/blog/unmasking-sneaky-2fa-how-modern-phishing-kits-bypass-mfa-in-2026/)
- [Astaroth Phishing Kit Bypasses 2FA Using Reverse Proxy Techniques](https://www.infosecurity-magazine.com/news/astaroth-phishing-kit-bypasses-2fa/)
- [AitM Phishing: How Attackers Bypass MFA and How to Stop Them](https://hivesecurity.gitlab.io/blog/aitm-phishing-mfa-bypass-evilginx/)
- [How Hackers Bypass MFA Using Real-Time Phishing Kits](https://guardiandigital.com/resources/blog/how-hackers-bypass-mfa-using-real-time-phishing-kits)
- [Malwarebytes Scam Guard Prevented High-Risk Fraud in 15% of Interactions](https://www.malwarebytes.com/press/2026/02/17/malwarebytes-scam-guard-prevented-high-risk-fraud-in-15-of-interactions-protecting-users-from-1000-in-losses-or-significant-personal-risk)
- [Scam Guard for desktop: A second set of eyes for suspicious moments](https://www.malwarebytes.com/blog/product/2026/02/scam-guard-for-desktop-a-second-set-of-eyes-for-suspicious-moments)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1674