Threat reportPhishingTL-2026-1736
Real-Time Credential Relay Phishing Campaign Targets Call of Duty Mobile Players via Fake CP Giveaway
Real-Time Credential Relay Phishing Campaign Targets Call of (TL-2026-1736), also tracked as Fake Call of Duty Mobile Free CP Giveaway Scam, is a medium-severity phishing campaign, first published 2026-07-28. It has no confirmed attribution, affects Activision Call of Duty Mobile, maps to 15 MITRE ATT&CK techniques (T1027, T1036, T1056), and is covered by 9 detection rules and 25 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 25Indicators of compromise
Key facts for TL-2026-1736
- Threat ID
- TL-2026-1736
- Also known as
- Fake Call of Duty Mobile Free CP Giveaway Scam, CoD Mobile Real-Time Credential Relay Phishing
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- gaming, consumer, entertainment
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 25
How Real-Time Credential Relay Phishing Campaign Targets Call of works
Malwarebytes disclosed a phishing campaign impersonating a Call of Duty Mobile "10,800 free CP" giveaway that uses real-time credential relay: submitted usernames/passwords are instantly forwarded to Activision's genuine login page, triggering a real 2FA code that a second spoofed page captures, giving attackers full account takeover of Activision, Xbox, PlayStation, and Battle.net-linked profiles and their stored payment methods.
On 2026-07-24, Malwarebytes threat intel researcher Stefan Dasic published analysis of a phishing campaign targeting the roughly 489-million-download Call of Duty Mobile player base with a fake "free Call of Duty Points" giveaway. The counterfeit landing page offers 10,800 CP in exchange for the victim's account email address and password, and claims reward confirmation takes four to eight hours -- a stalling tactic that delays victim suspicion. Rather than passively storing harvested credentials, the phishing kit performs a real-time credential relay (an adversary-in-the-middle pattern): the moment a victim submits their username and password, the phishing site immediately re-submits them to Activision's actual login page. Because the credentials are valid, Activision's real authentication flow issues a genuine time-limited two-factor authentication (2FA) code to the victim. A second, separately spoofed page then prompts the victim to enter that OTP, which the attacker captures and relays before it expires -- completing a full authentication bypass without ever needing to defeat 2FA cryptographically. The page carries documented tradecraft red flags: a call-to-action button reading "GET FREE POINT" (singular, missing the 's'), awkwardly worded instructions, and a non-functional fake live-chat widget added purely for perceived legitimacy. Because Activision accounts are commonly linked to Xbox, PlayStation, and Battle.net profiles -- several of which store payment methods for in-app/in-game purchases -- a successful takeover exposes a substantially wider blast radius than the CoD Mobile account alone, including potential unauthorized purchases. No CVE, software vulnerability, malware payload, or specific attacker infrastructure (domain, IP, certificate, or file hash) was disclosed in either the Malwarebytes source report or the Help Net Security summary as of 2026-07-28; this is a pure social-engineering / credential-theft campaign, not a code-execution threat. Malwarebytes' guidance for affected or at-risk players: change the Activision password immediately, treat the account as compromised and sign out all sessions if a 2FA code was ever entered on the fake page, review linked payment methods for unauthorized charges, and only access promotions through official apps or manually typed URLs rather than shared links. Beyond the login-page-typo and fake-live-chat red flags, both Malwarebytes and Help Net Security separately call out a visible countdown timer on the landing page as a distinct urgency-manufacturing element from the '4-8 hour reward confirmation' stalling claim, and Malwarebytes recommends its own Scam Guard, Browser Guard, and Mobile Security products as mitigations capable of flagging known phishing infrastructure of this type. This is not the first branded 'free CP' credential-phishing campaign against Call of Duty Mobile: MacSources documented a distinct 2024 campaign (domain activisioncodm.org, distributed via in-game chat messages, hosted on a WordPress/Elementor site with a tel.php credential-collection endpoint and base64-obfuscated scripts) using the identical lure pattern, indicating this is a recurring social-engineering TTP against the CoD Mobile player base rather than a one-off; no infrastructure overlap between the 2024 precedent and the 2026 campaign has been confirmed by either source.
MITRE ATT&CK techniques used in TL-2026-1736
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Collection
Command and Control
T1071 Application Layer Protocol
Initial Access
T1078 Valid Accounts; T1566 Phishing
Discovery
Credential Access
T1111 Multi-Factor Authentication Interception; T1557 Adversary-in-the-Middle
Execution
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1608 Stage Capabilities
Impact
stealth
Affected products and versions in Real-Time Credential Relay Phishing Campaign Targets Call of
- Activision — Call of Duty Mobile
Vulnerable versions: all current versions - account/credential targeting, not a software flaw - Microsoft — Xbox (linked account)
Vulnerable versions: accounts linked to a compromised Activision account - Sony — PlayStation Network (linked account)
Vulnerable versions: accounts linked to a compromised Activision account - Blizzard Entertainment — Battle.net (linked account)
Vulnerable versions: accounts linked to a compromised Activision account
Remediation for Real-Time Credential Relay Phishing Campaign Targets Call of
Immediate actions
- Change the Activision account password immediately if you interacted with the fake giveaway page
- If a 2FA/OTP code was ever entered on the fake page, treat the account as fully compromised
- Sign out of all active sessions/devices on the Activision account
- Review linked Xbox, PlayStation, and Battle.net accounts for unauthorized activity
- Check all stored payment methods linked to the account for unauthorized charges
Workarounds
- Verify the URL bar matches the official Call of Duty Mobile / Activision domain before entering any credentials
- Never enter a 2FA/OTP code on any page other than the official Activision login flow you initiated yourself
Longer-term hardening
- Educate players to access in-game promotions only via the official Call of Duty Mobile app or manually typed URLs, never via shared links
- Encourage use of hardware-backed or app-based authenticator 2FA over SMS/email OTP where the relaying platform supports it, since OTP-relay attacks target time-limited one-time codes specifically
- Monitor for lookalike/typosquat domains and fake giveaway pages impersonating official Call of Duty Mobile branding
- Deploy consumer-facing scam/browser protection (e.g., Malwarebytes Scam Guard/Browser Guard/Mobile Security) to flag known phishing infrastructure
Timeline of Real-Time Credential Relay Phishing Campaign Targets Call of
- The 2024 precedent phishing domain activisioncodm.org is registered, later found configured with a WordPress/Elementor 'Hello' theme site and a tel.php credential-collection endpoint, and issued a short (3-month) validity SSL certificate atypical for a legitimate corporate site.
- MacSources documents a distinct, earlier Call of Duty Mobile "free CP" credential-phishing campaign (domain activisioncodm.org, in-game-chat distribution via impersonation of compromised player accounts, WordPress/Elementor site with a tel.php credential endpoint and base64-obfuscated scripts with text/plain script tags), establishing this lure pattern as a recurring TTP against the CoD Mobile player base rather than a one-off; no confirmed infrastructure overlap with the 2026 campaign.
- Malwarebytes names its own Scam Guard, Browser Guard, and Mobile Security products as mitigations capable of flagging known phishing infrastructure of this type, alongside the general workaround guidance.
- Malwarebytes publishes remediation guidance: immediate password change, treating the account as compromised if a 2FA code was entered, session sign-out, and payment-method review.
- Malwarebytes researcher Stefan Dasic publishes the original threat intel blog disclosing the campaign, its lure mechanics, and its red flags.
- Malwarebytes documents the real-time credential relay flow: stolen credentials are immediately re-submitted to Activision's genuine login page, triggering a legitimate 2FA code captured by a second spoofed page.
- Malwarebytes identifies the fake Call of Duty Mobile "free CP" giveaway phishing campaign impersonating the official CoD Mobile site.
- TL-Intel Harness ingests the campaign via the RSS hunt phase (source: Help Net Security) and opens threat TL-2026-1736 for tracking.
- Help Net Security republishes and summarizes the Malwarebytes findings, four days after original disclosure, widening public awareness of the campaign.
Sources cited for Real-Time Credential Relay Phishing Campaign Targets Call of
- Call of Duty Mobile scam uses fake free points to steal player accounts
- Scammers exploit Call of Duty Mobile players with fake giveaways
- MITRE ATT&CK T1566 - Phishing
- MITRE ATT&CK T1111 - Two-Factor Authentication Interception
- MITRE ATT&CK T1056 - Input Capture
- MITRE ATT&CK T1036 - Masquerading
- MITRE ATT&CK T1557 - Adversary-in-the-Middle
- MITRE ATT&CK T1656 - Impersonation
- MITRE ATT&CK T1071.001 - Application Layer Protocol: Web Protocols
- Call Of Duty: Mobile (CODM) Free CP Scam (2024 precedent campaign)
- MITRE ATT&CK T1583.006 - Acquire Infrastructure: Web Services
- MITRE ATT&CK T1027 - Obfuscated Files or Information
- MITRE ATT&CK T1586 - Compromise Accounts
Detection coverage for TL-2026-1736
As of 2026-07-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1736 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.