Scams people are seeing right now

Fake Fiverr payout page asks freelancers for card details

A copy of the Fiverr website tells a freelancer that a buyer has already paid and that the money is waiting. To release it, a support chat that opens by itself asks for bank card details and calls it a one-time identification. The card number, expiry date and security code are collected on a second website. Being paid never requires your card number or security code.

Fake "GitHub Setup" download page pushes a suspicious Windows file

A site called gitappsdown[.]pro copies GitHub's look and offers a free "GitHub Setup" download for Windows. The giveaway: it hands you a password-protected file and shows you the password, which GitHub never does. Opening it can put malware on your computer. Download GitHub only from github[.]com.

Fake Samsung Brazil pages ask for a PIX fee to release an order or a gift card

A site using Samsung's name asks for your CPF, then shows an order or a cashback balance waiting for you. To release it you must pay a small fee by PIX: R$ 97,00 for a delivery, R$ 7,36 for a gift card. Nothing arrives. Check any order in the shop's own app instead.

A fake Booking hotel page asks you to confirm a reservation and verify your card

A page copying Booking's checkout asks you to verify your card to confirm a hotel reservation. A chat posing as Booking support says your bank may send a confirmation code. That code can approve a payment. Do not enter card details, and never pass a code on.

If a page says your lost iPhone was found, it should never ask for your phone's passcode

A message may tell you that your lost or stolen iPhone has been found, with a link to a map. The map looks convincing, but it is not Apple's, and the phone shown on it is not yours. Before it will show you anything, the page asks for the code you use to unlock your phone screen. Apple never asks for that code on a web page. If a page says the code is wrong and asks you to type it again, that is not a mistake on your part; it is how the page gets a second copy.

Trump-branded crypto giveaway website promises to double deposits

A website using Trump imagery and the name trumpamerica[.]io claims that people can send cryptocurrency and receive twice as much back. Its instructions tell visitors to send coins to a special address and say the doubled amount will be returned immediately. That is a classic cryptocurrency giveaway warning sign: sending funds does not create a right to receive anything back.

Do not accept a crypto payment based on a screenshot or fake explorer link

A website at cryptoflasher[.]net advertises a paid tool that claims to create temporary crypto credits, pending transfers, fake wallet balances, and fake blockchain-explorer pages showing a transaction as confirmed. A person could use that false proof to persuade someone to release goods, money, or services before a real payment exists. Verify every crypto payment independently on the correct blockchain before accepting it.

Fake Discord checks tell you to paste a command

A page that looks like Discord may show a Cloudflare-style check and tell you to press Win + R, paste text, and press Enter. That is not a human check. It can run a hidden PowerShell command on your Windows computer. Close the page and do not paste or run anything.

Do not install TuntunSahur malware

TuntunSahur malware may look like a harmless meme-related download, but it uses several ZIP files and a password to hide an installer reported to be malicious. Children and young gamers may be especially interested in the theme. Do not download or run it. If it was opened, tell a trusted adult and get help.

Fake e-challan texts may use legal threats to install an Android app

A text claims that an e-challan has been issued and threatens legal action unless a penalty is paid immediately. The message uses a shortened link instead of an official traffic or government address. The submitted report says the link downloads an Android APK described as a Trojan; the file was not available for independent analysis. Do not open the link or install the app. Check fines through the official government or traffic service opened independently.

Free game-download sites can expose children to unsafe launchers and files

A site branded SteamUnlocked presents free pre-installed PC games and promotes a separate launcher outside Steam's official store. A polished catalogue, game covers, and an 'official' claim can make the downloads feel safe, but the site and its files are not verified by Steam or the game publishers. Do not download or run unknown launchers or game files. Children should ask a parent or trusted adult before downloading games from an unfamiliar site.

Unexpected high-salary job emails may impersonate a real recruiter

An email claims to represent an executive search partner and offers a remote operations and executive-support role with a $200,000 compensation package. This example uses a free Gmail address while pointing to a profile associated with a large staffing firm, then asks for an updated résumé. Similar messages may use a lookalike or other unofficial domain that resembles the real firm's address. A familiar company name or real person's profile does not prove that the sender is genuine. Verify the opportunity through the firm's official website and contact details before sharing your résumé or personal information.

A cloud-storage address does not make a payment or sign-in page safe

A link may show the name of a familiar cloud-storage company such as Amazon, Cloudflare, or Backblaze while displaying a fake delivery, refund, prize, or account page. The storage company may only be hosting the file; it does not mean the offer belongs to the company shown on the page. Do not enter passwords, card details, identity numbers, or verification codes. Open the real organization's app or website yourself instead.

Fake Buffalo Couriers pages ask for your ID and card details to pay a delivery fee

A Buffalo Couriers-branded page shows a fake shipment summary and says an R18.99 shipping fee must be confirmed within 48 hours. A confirmation button leads to a second page that requests an ID or passport number, cellphone number, card number, expiry date, and CVV. The pages are hosted on an unrelated address, and the second page's code sends submitted information to an unknown Telegram recipient. Do not enter details or pay through the pages; check deliveries through the courier's official website or app opened independently.

Fake Tim Hortons prize page asks you to share before you can continue

A page using Tim Hortons branding says the visitor has won a $200 gift card and asks them to share it with multiple groups or friends through Messenger or WhatsApp before continuing. Links shown for people who receive the shared page use unrelated domains, including assaitssapp[.]com and assaibonus[.]com. Do not share the page or enter information on it; verify promotions through the official Tim Hortons app or website opened independently.

Fake Zoom meeting pages can download malware

A page at quickmeetinglink[.]es copies Zoom branding and claims that the latest Zoom Workplace app is required to join a meeting. It directs visitors to download a file before continuing. The downloaded file was flagged as malware. Close the page, delete the file, and open Zoom through its official app or website instead.

Kids, students, and gamers: fake itch[.]io game updates can install malware

A GitHub Pages site at jessellis95[.]github[.]io/update/ copies itch[.]io and offers a password-protected ZIP as a game update for Windows and macOS. The archive contains malware, not a game. Its macOS instructions tell you to paste a remote command into Terminal and enter your computer password; the Windows download contains an obfuscated executable package. Do not download, extract, run, or follow instructions from this page.

Fake Vrbo booking site looks identical to the real thing

reservation[.]holiday-vrbo[.]com copies Vrbo branding and presents a fake-looking vacation-rental booking flow. It offers a property listing, a “Book now” button, contact fields, a message-to-host form, and a large deposit. The domain is not Vrbo. Do not enter information or pay through this site.

Fake printer support pages offer remote access

A printer-support page using printer-company branding shows an alarming error, asks you to download a driver, and offers remote-access tools. Do not download anything or let an unfamiliar person control your computer. Use the printer company's official website instead.

Fake Zoom meetings try to get you to install a plug-in or “update”

You click a Zoom meeting invite and land on a page that looks like the Microsoft Store. It says you need a plug-in or an update before you can join, then starts downloading a file. That is not how you should join a Zoom meeting. Close the page and do not open the download.

Fake Signal support messages can ask for recovery keys

A message pretending to be Signal support claims that an account is at risk and asks the recipient to click Accept and provide a recovery key. This is a scam warning: never share a recovery key, registration code, verification code, password, or other account secret in response to an unexpected message.

Lookalike game sites can steal player information

A website using the address vwww-roblox[.]co uses Roblox's name with an unusual vwww- prefix and a different domain ending. Lookalike game sites can be used to trick players into entering passwords, verification codes, or payment details. Do not sign in through a link sent in a chat, video, ad, or game message.

A phishing campaign impersonating the Canadian government shows signs of preparing German government lures

A CSRF investigation mapped a phishing email impersonating the Government of Canada and Service Canada. The Canadian redirect chain is now offline, but the same GitHub account uploaded a logo belonging to Germany's Federal Motor Transport Authority (KBA) on 2026-08-07. This suggests preparation for a possible German pivot; no live German phishing page has been confirmed. CSRF reported the GitHub account to GitHub.

A suspected Zillow impersonation site may lead to a task scam

A reported website uses Zillow branding while presenting an agent or in-house tester program. Its FAQ describes daily order sets, negative balances on premium tasks, and topping up an account before work can continue. A separate domain is reported as the support destination. These are strong warning signs associated with task scams and impersonation, but this alert does not establish who operates the sites or whether Zillow was involved.

A suspected Nike recruitment impersonation site uses a Facebook-style login

A reported recruitment-themed website at nikerecruits[.]com appears to use Nike branding and presents a Facebook-style sign-in page. The combination may be intended to trick visitors into entering account credentials. This is an initial warning based on the reported page appearance and requires review before publication.