# Real-Time Credential Relay Phishing Campaign Targets Call of Duty Mobile Players via Fake CP Giveaway

> Malwarebytes disclosed a phishing campaign impersonating a Call of Duty Mobile "10,800 free CP" giveaway that uses real-time credential relay: submitted usernames/passwords are instantly forwarded to Activision's genuine login page, triggering a real 2FA code that a second spoofed page captures, giving attackers full account takeover of Activision, Xbox, PlayStation, and Battle.net-linked profiles and their stored payment methods.

- **Published:** 2026-07-28T00:00:00Z
- **Last reviewed:** 2026-07-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1736
- **ID:** TL-2026-1736
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-24, Malwarebytes threat intel researcher Stefan Dasic published analysis of a phishing campaign targeting the roughly 489-million-download Call of Duty Mobile player base with a fake "free Call of Duty Points" giveaway. The counterfeit landing page offers 10,800 CP in exchange for the victim's account email address and password, and claims reward confirmation takes four to eight hours -- a stalling tactic that delays victim suspicion. Rather than passively storing harvested credentials, the phishing kit performs a real-time credential relay (an adversary-in-the-middle pattern): the moment a victim submits their username and password, the phishing site immediately re-submits them to Activision's actual login page. Because the credentials are valid, Activision's real authentication flow issues a genuine time-limited two-factor authentication (2FA) code to the victim. A second, separately spoofed page then prompts the victim to enter that OTP, which the attacker captures and relays before it expires -- completing a full authentication bypass without ever needing to defeat 2FA cryptographically. The page carries documented tradecraft red flags: a call-to-action button reading "GET FREE POINT" (singular, missing the 's'), awkwardly worded instructions, and a non-functional fake live-chat widget added purely for perceived legitimacy. Because Activision accounts are commonly linked to Xbox, PlayStation, and Battle.net profiles -- several of which store payment methods for in-app/in-game purchases -- a successful takeover exposes a substantially wider blast radius than the CoD Mobile account alone, including potential unauthorized purchases. No CVE, software vulnerability, malware payload, or specific attacker infrastructure (domain, IP, certificate, or file hash) was disclosed in either the Malwarebytes source report or the Help Net Security summary as of 2026-07-28; this is a pure social-engineering / credential-theft campaign, not a code-execution threat. Malwarebytes' guidance for affected or at-risk players: change the Activision password immediately, treat the account as compromised and sign out all sessions if a 2FA code was ever entered on the fake page, review linked payment methods for unauthorized charges, and only access promotions through official apps or manually typed URLs rather than shared links. Beyond the login-page-typo and fake-live-chat red flags, both Malwarebytes and Help Net Security separately call out a visible countdown timer on the landing page as a distinct urgency-manufacturing element from the '4-8 hour reward confirmation' stalling claim, and Malwarebytes recommends its own Scam Guard, Browser Guard, and Mobile Security products as mitigations capable of flagging known phishing infrastructure of this type. This is not the first branded 'free CP' credential-phishing campaign against Call of Duty Mobile: MacSources documented a distinct 2024 campaign (domain activisioncodm.org, distributed via in-game chat messages, hosted on a WordPress/Elementor site with a tel.php credential-collection endpoint and base64-obfuscated scripts) using the identical lure pattern, indicating this is a recurring social-engineering TTP against the CoD Mobile player base rather than a one-off; no infrastructure overlap between the 2024 precedent and the 2026 campaign has been confirmed by either source.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1036 Masquerading
- T1684.001 Impersonation
- T1566 Phishing
- T1204 User Execution
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1056 Input Capture
- T1071 Application Layer Protocol
- T1078 Valid Accounts
- T1087 Account Discovery
- T1657 Financial Theft
- T1027 Obfuscated Files or Information
- T1586 Compromise Accounts

## Sources

- [Call of Duty Mobile scam uses fake free points to steal player accounts](https://www.malwarebytes.com/blog/threat-intel/2026/07/call-of-duty-mobile-scam-uses-fake-free-points-to-steal-player-accounts)
- [Scammers exploit Call of Duty Mobile players with fake giveaways](https://www.helpnetsecurity.com/2026/07/28/call-of-duty-mobile-players-scam/)
- [MITRE ATT&CK T1566 - Phishing](https://attack.mitre.org/techniques/T1566/)
- [MITRE ATT&CK T1111 - Two-Factor Authentication Interception](https://attack.mitre.org/techniques/T1111/)
- [MITRE ATT&CK T1056 - Input Capture](https://attack.mitre.org/techniques/T1056/)
- [MITRE ATT&CK T1036 - Masquerading](https://attack.mitre.org/techniques/T1036/)
- [MITRE ATT&CK T1557 - Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557/)
- [MITRE ATT&CK T1656 - Impersonation](https://attack.mitre.org/techniques/T1656/)
- [MITRE ATT&CK T1071.001 - Application Layer Protocol: Web Protocols](https://attack.mitre.org/techniques/T1071/001/)
- [Call Of Duty: Mobile (CODM) Free CP Scam (2024 precedent campaign)](https://macsources.com/call-of-duty-mobile-codm-free-cp-scam/)
- [MITRE ATT&CK T1583.006 - Acquire Infrastructure: Web Services](https://attack.mitre.org/techniques/T1583/006/)
- [MITRE ATT&CK T1027 - Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027/)
- [MITRE ATT&CK T1586 - Compromise Accounts](https://attack.mitre.org/techniques/T1586/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1736