Call of Duty Mobile scam uses fake free points giveaway to hijack players’ accounts

Call of Duty Mobile players should watch out for a phishing campaign disguised as a free Call of Duty Points giveaway, Malwarebytes researchers have warned.

Victims are asked to log in with their email address and password to claim free Call of Duty Points (CP), the game’s premium currency, before being redirected to a second page requesting their 2FA code.

“The site has no connection to Activision. Its only purpose is to steal the login details needed to take over accounts,” the researchers said.

Call of Duty Mobile has been downloaded an estimated 489 million times and generated around $1.8 billion in lifetime in-app purchases, according to Malwarebytes.

An Activision account is often worth more than the in-game points it holds. Players frequently link the account to Xbox, PlayStation, or Battle.net profiles, so a takeover can expose stored payment methods, purchase history, and other connected accounts.

How the scam works

Disguised as the official Call of Duty Mobile site, the first phishing page offers 10,800 free Call of Duty Points in exchange for an email address and password rather than a legitimate redemption code. A message on the page tells visitors their reward will be “confirmed” within four to eight hours, buying time for the scammers.

A fake Call of Duty Mobile site (Source: Malwarebytes)

“There are warning signs, though,” the researchers noted. The page reads “GET FREE POINT” instead of “GET FREE POINTS,” the instructions are worded awkwardly, and it includes a live chat widget that appears to exist only to make the site look more legitimate.

The redirect that follows relies on a technique known as a real-time credential relay. Rather than storing stolen usernames and passwords to use later, the phishing site forwards them directly to Activision’s real login page the moment they’re entered. That can trigger a genuine 2FA code, and it’s this code the second page is designed to capture before it expires.

“The victim ends up handing over everything needed to access their real account: their password and the one-time code that’s supposed to keep attackers out,” the researchers added.

What to do if you entered your details

Security researchers recommend the following steps for anyone who submitted credentials on the fake page:

• Change the Activision password immediately.
• If a 2FA code was entered, treat the account as compromised, review recent account activity, and sign out of all active sessions.
• Check linked payment methods for unauthorized charges.

The safest way to claim any in-game promotion is to go directly to the source by opening the official app or typing the publisher’s website address into a browser, rather than following links in messages, social media posts, or ads.