Instant Defense Against Scams, Phishing & Fake Receipts
Scan links, messages, screenshots or files before you act.
Free for everyone — no sign-up. Uploads are analyzed in memory and purged right after scanning.
Live Threat Feed: Recent Scams & News
AI-summarized reports of active scam campaigns, refreshed continuously.
Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks
Attackers are using phishing emails disguised as meeting invitations or software updates to trick users into downloading remote monitoring tools. Once installed, these legitimate tools are abused to grant scammers complete remote access to the victim's computer.
- Unexpected meeting invitations or PDF attachments that prompt you to download software
- Downloaded files with deceptive or unusual file names
- Prompts to install remote management tools like MSP360 or ScreenConnect
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
Cybercriminals are abusing ChatGPT's Custom GPT feature by creating fake helper bots that redirect users to malicious external websites. Once on these sites, users are tricked by 'ClickFix' prompts into running commands that install dangerous Remote Access Trojans on their computers.
- A Custom GPT that immediately forces you to visit an external website.
- Websites instructing you to copy and paste code or commands into your computer's terminal to fix an error.
- Unexpected prompts to download files or software updates to view content.
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access
This targeted phishing campaign specifically attacks corporate executives to steal Microsoft 365 login sessions. Once inside, attackers install remote access tools to take full control of the compromised accounts and conduct further fraud.
- Unsolicited emails asking to verify or log into Microsoft 365 accounts
- Unexpected requests to authorize remote access software
- Urgent or unusual messages targeting high-level company executives
What to know ahead of Open Enrollment to avoid health insurance scams
Scammers often use paid search engine advertisements to place fraudulent health insurance websites at the top of search results during Open Enrollment. Consumers should verify they are on official government portals like Medicare.gov or HealthCare.gov before entering any personal or financial information.
- Sponsored search results appearing at the top of Google or Bing instead of official government sites
- Websites asking for payment or bank information just to view insurance quotes
- Salespeople using high-pressure tactics or claiming you will lose benefits if you do not act immediately
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
A U.S. soldier has been sentenced to nearly six years in prison for hacking into AT&T and Verizon to steal the call and text records of over 100 million customers. While the stolen data did not include the actual content of messages, scammers can still use this metadata to design highly convincing targeted phishing attacks.
- Unsolicited calls or texts claiming to have details about your recent communications
- Urgent requests from utility or phone companies asking you to verify sensitive account information
- Receiving unexpected security codes or password reset links on your phone
How to report a platform that doesn't take down your intimate images
If an online platform fails to remove your non-consensual intimate images within 48 hours, you can now report them directly to the FTC. This reporting tool helps hold websites accountable under the Take It Down Act and assists victims of online image abuse.
- An online platform ignores your request to remove intimate media
- Intimate photos or videos of you are posted online without your consent
Did an online platform fail to quickly take down your intimate images? Report it to the FTC
Online platforms are legally required to provide an easy way to request the removal of intimate images shared without your consent. If a platform fails to take down these images within 48 hours of your request, you can report them to the FTC.
- A platform lacks a clear or accessible tool to submit content takedown requests
- Intimate images remain publicly visible more than 48 hours after a formal removal request is submitted
Scammers are impersonating farm equipment businesses
Scammers are posing as legitimate farm equipment dealers to sell non-existent machinery to farmers. Victims pay upfront for the equipment but ultimately receive nothing, resulting in massive financial losses.
- Prices that are significantly lower than standard market rates.
- Insistence on wire transfers, certified checks, or peer-to-peer payment apps.
- Refusal to allow in-person inspections of the machinery before buying.
Was your intimate image shared online without your consent? Here’s what to do
Victims of non-consensual intimate image sharing or digitally altered deepfakes have legal rights and can demand that online platforms remove the content. It is crucial to document the evidence immediately and report the abuse to both law enforcement and the hosting websites to protect your privacy.
- An online acquaintance threatens to share private or altered images of you if you do not pay them.
- A stranger requests intimate photos or personal information shortly after connecting online.
- You discover highly realistic but fake explicit images of yourself posted on social media platforms.
This National Preparedness Month, plan ahead to avoid scams
National Preparedness Month serves as a crucial reminder to protect yourself from opportunistic fraudsters who exploit natural disasters. Planning ahead can help you spot and avoid common post-disaster scams, such as fraudulent charity solicitations and dishonest cleanup contractors.
- Contractors demanding upfront payment before disaster cleanup work begins
- High-pressure charity donation requests that demand immediate payment
- Requests for payments via wire transfers, gift cards, or cryptocurrency
See a QR code parked somewhere? Don’t scan it…yet!
Scammers are covering legitimate QR codes on parking meters with fake stickers to trick drivers into visiting fraudulent payment sites. Scanning these malicious codes can result in stolen credit card information and identity theft.
- A QR code sticker that looks peeling, layered, or pasted over an existing code
- A payment website URL that does not match the official city or parking company domain
- Requests for excessive personal details or account creation just to pay for parking
FBI Probes Service Selling 153M+ Drivers Licenses
A new dark web service is selling digital scans of over 153 million driver's licenses stolen from a major identity verification company. Scammers can use these stolen official IDs to impersonate victims and open fraudulent bank accounts or loans.
- Unexplained credit score changes or alerts about new accounts you did not open.
- Receiving physical mail, like credit cards or bills, in your name for services you never requested.
- Receiving identity verification codes or login alerts for services you are not currently using.
Scammers are spoofing car dealership websites: What you need to know
Scammers are creating convincing copies of real car dealership websites to trick buyers into paying for non-existent vehicles. Victims only realize they have been defrauded when they show up at the actual dealership to collect their car and find no record of the transaction.
- The website URL has spelling errors or differs slightly from the official dealership brand.
- The dealer demands upfront wire transfers, cryptocurrency, or gift cards for payment.
- The price of the vehicle is significantly lower than market value.
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Cybercriminals are hiding a dangerous backdoor malware inside a seemingly harmless desktop wallpaper application. Users are tricked into disabling their antivirus protection for this software, giving attackers complete control over their computers.
- An application asks you to add it to your antivirus exclusion list.
- Unusual security warnings appear when trying to install a simple wallpaper or customization tool.
- The software requires you to bypass standard operating system security blocks to run.
TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor
Scammers are using fake Cloudflare CAPTCHA pages to trick users into copying and running malicious commands in Windows Terminal or PowerShell. Running these commands installs a backdoor that grants attackers remote access to the victim's computer.
- A CAPTCHA prompt that asks you to copy and paste code to verify you are human
- Instructions telling you to open Windows Terminal, PowerShell, or the Run dialog
- Websites that require keyboard shortcuts like 'Windows Key + X' to access content
Did you spot a scam? Here’s what to do next
Reporting scams to the FTC and sharing your experiences with loved ones is crucial to stopping fraudsters. This guide explains how speaking up helps law enforcement track down criminals and prevents others from falling victim.
- Scammers demanding that you keep a transaction secret
- Pressure to pay immediately using unusual methods like gift cards or wire transfers
- Unsolicited messages urging you to act quickly to resolve a problem
When donating, support those in need, not a scammer
Scammers often exploit natural disasters by setting up fake charities to steal donations meant for victims. Before giving, research organizations carefully and avoid donating to anyone demanding payment via cash, gift cards, or cryptocurrency.
- High-pressure tactics pushing you to donate immediately
- Demands for payment via gift cards, wire transfers, or cryptocurrency
- Vague descriptions of how the money will actually help victims
How to spot a postcard scam targeting veterans
Scammers are sending physical postcards to veterans claiming they qualify for a fictitious 'Veterans Savings Program' to steal their personal and financial details. To protect yourself, do not call the numbers listed on unsolicited mail and verify any benefit offers directly through official government channels.
- Unsolicited postcards offering vague, extra veteran benefits
- References to a non-existent 'Veterans Savings Program'
- Urgent requests for sensitive personal or financial information
That unexpected package you got could be a brushing scam
A brushing scam occurs when you receive unordered packages from online sellers who use your name to write fake positive reviews. While the items may seem harmless, receiving them indicates that a scammer likely has access to your personal information.
- Receiving unexpected packages you never ordered
- Packages with unfamiliar return addresses from random online sellers
- Finding online product reviews under your name that you did not write
Phishing 3.0: The Fight Moves to Agent Versus Agent
Phishing attacks are rapidly shifting from simple malicious links to sophisticated, AI-driven conversations designed to trick targets. As cybercriminals deploy automated AI agents, these scams become highly personalized and much harder for traditional email filters to catch.
- Emails that try to start a casual conversation without containing any immediate links or attachments
- Highly personalized messages that still pressure you to perform urgent financial or account actions
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Cybercriminals are hijacking thousands of legitimate WordPress websites to distribute malware and steal personal data from visitors. This widespread operation uses compromised sites to secretly download malicious tools onto users' devices and track their online activities.
- Unexpected file download prompts when visiting familiar websites
- Sudden redirects to unfamiliar web addresses
- Security warnings from your browser about a site being unsafe
Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure
Microsoft researchers have uncovered a network of over 30 domains used to distribute and manage 'MacSync Stealer,' a malware targeting Mac users to steal sensitive personal data. This malicious software silently exfiltrates saved passwords, browser cookies, and financial information from infected devices.
- Prompts to bypass macOS Gatekeeper or security settings to install an app
- Downloading software or updates from unofficial, third-party websites
- Unexpected prompts asking for your macOS administrator password
Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
Security researchers have discovered vulnerabilities in Microsoft Copilot Personal that allow attackers to steal private data if a user clicks on a malicious link. This exploit, named CoSnitch, can silently exfiltrate information from connected applications without the victim's knowledge.
- Unsolicited or suspicious links received in emails or chats
- Messages urging you to click a link to configure or update your AI assistant
- Unexpected account activity or data access alerts in your connected apps
Fake bank "account suspended" emails surge across major retail banks
Attackers are sending mass emails claiming a customer's account is suspended pending identity verification. The linked page is a pixel-perfect clone of the bank login hosted on a lookalike domain registered days earlier.
- Lookalike domain registered within the last 14 days
- Urgent 24-hour deadline to "restore access"
- Login page asks for full card number and PIN
AI voice clones of family members used in emergency money scams
Criminals scrape short voice clips from social media and generate cloned audio of a relative in distress. Victims are pressured to send instant transfers before they can verify the call.
- Caller refuses a video call or callback
- Payment demanded via instant transfer or gift cards
- Story insists on absolute secrecy from other family
French tax authority data breach affects 678,000 individuals
A major data breach at the French tax authority has exposed the personal information of over 678,000 individuals. Cybercriminals are highly likely to use this stolen data to launch targeted phishing scams and identity theft attempts.
- Unsolicited emails or text messages claiming you owe taxes or are due a sudden refund
- Urgent demands for immediate payment or sensitive personal information to avoid penalties
- Links in tax-related messages that lead to unofficial websites instead of official government portals
Forged UPI payment screenshots used to defraud small shopkeepers
Fraudsters show a doctored payment-success screenshot at checkout and walk away with goods before the merchant checks the bank app. The forged receipts copy real app fonts but get transaction reference formats wrong.
- Reference number length does not match the real app
- Timestamp does not align with the bank notification
- Buyer rushes the merchant to skip verification
Searching online: bill pay impersonators
Scammers are using paid search engine advertisements to impersonate legitimate bill-paying websites and steal consumer funds. To avoid this trap, consumers should type the company's web address directly into their browser instead of relying on search engine results.
- The search result is marked as 'Sponsored' or 'Ad'
- The website URL contains typos or extra words not matching the official brand
- The site asks for payment methods not normally accepted by the real utility or service provider
WhatsApp "wrong number" chats escalate into investment fraud
A friendly wrong-number message builds rapport over days before pivoting to a "guaranteed return" crypto platform. Early withdrawals are honoured to build trust before a large deposit disappears.
- Unsolicited chat from an international number
- Screenshots of implausible daily profits
- Withdrawals blocked behind a surprise "tax fee"
SafePal data breach impacts 39,798 customers, stolen info for sale
A data breach at hardware wallet provider SafePal has exposed the personal order information of nearly 40,000 customers. This stolen data is now being sold online, raising the risk of highly targeted phishing campaigns aimed at cryptocurrency owners.
- Unsolicited emails or text messages asking you to 'verify' your hardware wallet
- Any request asking you to share your 12- or 24-word recovery seed phrase
- Unexpected packages containing 'replacement' hardware wallets that you did not order
Behind ScamBeacon
Sanidhya Mondhe
Founder & Lead Developer
“I built ScamBeacon to give everyday internet users a fast, reliable, and AI-powered shield against rising phishing attacks, fake receipts, and online scams.”
sanidhyamondhe2@gmail.com