walmart

Walmart co-locates red and blue teams to build trust and improve security through collaborative purple teaming exercises

The big-box giant has scaled its defenses by encouraging trust and innovation. Good communications, transparency, and team spirit are key factors.

Shoppers browsing on their phones are landing on convincing Walmart lookalike sites offering name-brand liquor at 40% to 70% off, only to be led straight to a checkout page asking for a full credit card number, expiry date, and CVV. The sites have no connection to Walmart. They’re part of a network of more than 120 near-identical domains built to look like a legitimate retailer just long enough to steal your card details. Fake Walmart websites The name “Walmart” is doing most of the work here. It’s one of the most recognized retailers in the world, and it’s that familiarity that makes people lower their guard. A shopper who’d hesitate on an unfamiliar website may think nothing of an unusually large discount because the logo, colours, and layout look familiar. That trust hasn’t been earned by the site. It’s borrowed from a brand that has nothing to do with it. If you’ve entered your card details on one of these pages, the safest assumption is that your card has been compromised. How the scam works The scam follows a simple pattern: a Walmart-branded homepage, category pages stacked with heavily discounted liquor, and a checkout form asking for full card details. The discounts do much of the persuading. Seeing premium brands advertised at 60% or 70% off encourages people to buy first and ask questions later. The same WordPress/WooCommerce template powers every site in the network. They share the same product catalogue, prices, and images. The only differences are fabricated US business addresses and phone numbers that are swapped out for each domain. How to avoid this scam Be sceptical of discounts that don’t match a retailer’s usual promotions, especially on liquor or electronics. Check the address bar before entering payment details. A genuine Walmart sale won’t send you to an unfamiliar .shop domain. Use tools that can identify scam websites automatically, such as Malwarebytes Browser Guard on desktop, or ask Scam Guard if it thinks a domain is suspicious. On mobile, where these sites are designed to work, Malwarebytes Mobile Security can block known phishing and scam domains before you reach the checkout. If you already entered your card details Contact your card issuer immediately. Explain what happened and ask whether the card should be cancelled and replaced. Watch your account for unauthorized charges, including small “test” transactions. Report the domain through your browser’s phishing reporting feature and to the FTC at reportfraud.ftc.gov if you’re in the US. The simplest defence is also the most effective: if a retailer needs a lookalike domain to sell you something, it’s probably a scam. Indicators of Compromise (IOCs) allgoodscenter.shop, allneedsbay.shop, allneedslane.shop, allneedsmarket.shop, allneedsstore.shop, allpurposebay.shop, basketandmore.shop, broadbasket.shop, broadbasketbay.shop, broadbasketco.shop, broadbasketlane.shop, broadbasketplace.shop, broadbasketway.shop, broadchoice.shop, broadgoodsbay.shop, broadgoodscenter.shop, broadgoodsplace.shop, broadgoodsway.shop, broadmarketplacehub.shop, broadutility.shop, broadutilityhub.shop, broadvalue.shop, broadvaluebay.shop, broadvalueplace.shop, cartandcrate.shop, completehomegoods.shop, dailybasketport.shop, dailybasketway.shop, dailychoiceway.shop, dailycrate.shop, dailyfindslane.shop, dailygoodscrest.shop, dailygoodsfield.shop, dailygoodspark.shop, dailygoodsridge.shop, dailygoodsway.shop, dailygoodswayhub.shop, dailyhomemarket.shop, dailyutilitybay.shop, dailyutilityway.shop, everydaycartshop.shop, everydayneedsco.shop, everydayvaluebay.shop, generalcart.shop, generalcartlane.shop, generalgoodsport.shop, generalgoodsridge.shop, generalgoodsway.shop, generalgoodsyard.shop, generalmarketbay.shop, generalmarketfield.shop, generalneedsplace.shop, generalvaluebay.shop, goodsandhomebay.shop, goodsandhomeco.shop, goodsandhomehub.shop, goodsandlivinghub.shop, goodsandmoreco.shop, goodsandvaluehub.shop, goodsdistrict.shop, goodslanding.shop, goodsmeadow.shop, goodsroute.shop, goodsvalley.shop, homeandutility.shop, homebasketlane.shop, homebasketway.shop, homecartcenter.shop, homefieldmarket.shop, homefindsco.shop, homegoodscrate.shop, homegoodsport.shop, homegoodsway.shop, homelivinggoods.shop, homeneedslane.shop, homeneedsmarket.shop, homeparcel.shop, homesteadmart.shop, homeutilitystore.shop, homevaluebay.shop, homevalueplace.shop, homevalueway.shop, marketbasketcenter.shop, marketcanvas.shop, marketchoicebay.shop, marketchoiceplace.shop, marketfieldhub.shop, marketfindsbay.shop, marketfoundry.shop, marketgrovehub.shop, markethomeplace.shop, marketpillar.shop, marketpine.shop, marketridge.shop, markettrailway.shop, marketwarehouse.shop, modernsupplyhub.shop, smartbasketplace.shop, smartdailygoods.shop, smartneedshub.shop, smartutilityhub.shop, smartvaluebay.shop, trustedgoods.shop, usefulbasketlane.shop, usefulcartcenter.shop, usefulchoicebay.shop, usefuldailyhub.shop, usefulgoodsbay.shop, usefulgoodscenter.shop, usefulgoodspark.shop, usefulgoodsway.shop, usefulgoodswayhub.shop, usefulgoodsyard.shop, usefulmarket.shop, usefulmarketbay.shop, usefulshelf.shop, usefulutility.shop, usefulvalueplace.shop, utilitygoods.shop, valuechoicebay.shop, valuegoodspark.shop, valuegoodsridge.shop, valuegrove.shop, valueparcel.shop Stop threats before they can do any harm. Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

A prolific initial access broker (IAB) who played a key role in dozens of ransomware attacks costing victims over $9m, has been sentenced to 81 months behind bars in the US. Russian national, Aleksei Volkov, 26, of St. Petersburg, was sentenced in an Indiana court yesterday. He pleaded guilty last November to unlawful transfer of a means of identification, trafficking in access information, access device fraud, and aggravated identity theft. He had also pleaded guilty in a Pennsylvania court to conspiracy to commit computer fraud and conspiracy to commit money laundering, before the cases were consolidated in Indiana. Volkov and his co-conspirators admitted to hacking victims’ networks, stealing their data, deploying ransomware and then dividing between themselves the ransom they subsequently extorted. The Department of Justice (DoJ) claimed that they tried to extort victim organizations to the tune of $24m. Volkov was accused of working as an IAB for several “major cybercrime groups,” including the Yanluowang ransomware operation. IABs continue to comprise an important part of the cybercrime supply chain, selling unauthorized access to networks to mainly ransomware-as-a-service (RaaS) outfits. This helps to lower the barriers to entry for these groups, while also speeding up attacks. Yanluowang Ransomware Unmasked Yanluowang was first spotted in 2021 using aggressive "triple extortion" tactics whereby data would be stolen and encrypted and then victims threatened with DDoS as well as “calls to employees and business partners” if they didn’t pay up. Despite the name, which references a Chinese deity linked to the underworld, the group was subsequently found to be Russian. It was unmasked by researchers in 2022 after a whistleblower shared thousands of internal messages on Twitter. Among its members were leader and payroll manager “Saint,” lead developer Killanas (aka "coder0") and pen-testers “Felix” and “Shoker.” The group counted Cisco and Walmart among its victims. In a rare move, Volkov eschewed the relative safety of Russia and was arrested in Rome in 2024 after being indicted in the US the previous year. He was then extradited to the US in 2025. He has agreed to pay restitution of at least $9.2m to compensate known victims for their losses.

Refund fraud is no longer just opportunistic abuse of return policies. Instead, it has evolved into a structured underground marketplace where fraud techniques are packaged and sold like digital products. An analysis of thousands of posts from fraud-focused online communities by Flare researchers reveals a thriving ecosystem where actors openly advertise refund “methods,” tutorials, and operational services designed to exploit the refund workflows of major retailers and payment platforms. Instead of relying on malware or sophisticated hacking, these schemes weaponize something far simpler: knowledge of customer service processes and payment dispute systems. By manipulating procedures originally designed to protect consumers, fraudsters can reliably extract money or goods from companies - turning refund policies into a scalable fraud business. A Glimpse to Refund Fraud When you buy something, it could be a household appliance, a video game, or milk, you often have the option to replace or return it. Refund fraud refers to a situation when individuals abuse the refund option to obtain cash, replacements, or credit from companies without legitimately returning products or services. Refund fraud is generally considered a form of social engineering, although it sometimes also overlaps with financial fraud and account takeover techniques, typically exploiting business processes and customer support policies. Threat actors take advantage of return guarantees, chargeback systems, and customer-service escalation procedures to convince companies to issue refunds even when the purchase was legitimate. Common examples include: Claiming a product never arrived Returning empty packages or counterfeit items Disputing legitimate charges with banks or payment providers Reporting items as defective to obtain refunds Because many retailers prioritize fast customer resolution and minimal friction in returns, these systems can be manipulated by actors who understand how internal processes work. While businesses continuously collect intelligence on emerging fraud techniques, threat actors are constantly testing and refining their methods, creating the classic cat-and-mouse dynamic. As a result, organizations must continuously gather threat intelligence and learn from one another to maintain an up-to-date understanding of the threat landscape; otherwise, they risk losing millions of dollars. Flare tracks underground forums and Telegram channels where fraudsters trade refund methods, tutorials, and services targeting major retailers. See (for free) how our threat intelligence helps detect emerging fraud techniques before losses mount. Try Flare’s Dark Web Monitoring for Free A Growing Problem Costing Retailers Billions In consumer retail markets, the expectations skyrocket as they expect full flexibility to return goods. Surveys conducted by the National Retail Federation and retail technology firm Narvar show that roughly 76% of consumers say free returns influence where they choose to shop, making it difficult for retailers to tighten refund policies without affecting legitimate customers. This makes a great foundation for refund fraud to evolve and increase. It has become one of the costliest types of e-commerce fraud. According to the National Retail Federation (NRF) and Appriss Retail, retailers processed roughly $685 billion worth of returned merchandise in 2024, representing about 13% of total retail sales. Of those returns, approximately $103 billion (~15%) were estimated to be fraudulent. Another piece of research indicates that per each $1 lost to fraud, businesses lose additional $4 for operational costs. Analyzing Black Markets’ Refund Fraud Posts Finding the relevant posts was a challenge.. We started by looking for “refund” posts and ended up with more than 30 million posts. We narrowed down the scope and found various interesting leads, and the most interesting one was by defining (“refund” and “method” or “tutorial”), which eventually led to almost 8 million results with a couple of hundred thousand per month. Flare researchers sampled a dataset of 3,686 posts to further understand how refund fraud is being operationalized in the underground. The analysis revealed a commercial ecosystem where actors advertise refund techniques in ways similar to legitimate digital content. The tutorial becomes “an online course” teaching its students how to defraud businesses. Although the dataset contained 3,686 posts, only about 1,639 messages were unique, indicating that actors frequently repost the same advertisements across multiple communities to increase visibility and attract buyers. Most posts promoted what sellers describe as refund methods, refund tutorials, step-by-step guides, and vendor refund services. Prices for tutorials commonly ranged between $50 and $300, suggesting the market is designed to attract both experienced fraud actors and novices seeking inexpensive entry points. Some advertisements also offered operators who perform the refund on behalf of customers, typically operating on commission models where the seller keeps between 30% and 50% of the refunded value, which may indicate that the “SaaS” business model has also evolved in the more classical fraud ecosystem. Refund Fraud Methods Sold Online While underground advertisements rarely reveal full operational details (this is what they actually sell), the terminology used in posts aligns with several known refund fraud techniques: Refund without return: In this scheme, fraudsters convince a retailer to issue a refund while allowing them to keep the purchased item. Claims that a product was defective, damaged, or never delivered are often used to trigger refunds. Chargeback fraud: Another common tactic involves disputing legitimate transactions through banks or payment providers. This type of fraud, sometimes referred to as friendly fraud, forces merchants to issue refunds and pay additional chargeback processing fees. Goods swapping: Fraudsters may return a different or lower-value item than the original purchase. For example, counterfeit or damaged products may be returned while the original item is kept or resold. Empty-box returns: In some cases, fraudsters ship back packages containing no product or cheap substitutes while claiming the original item was returned. If the package is processed quickly or inspection procedures are limited, the refund may be issued before the fraud is detected. Policy manipulation: Some refund methods focus on exploiting specific company policies, such as repeatedly reporting missing items in deliveries or requesting replacements under warranty programs. These tactics often rely heavily on social engineering and knowledge of customer support processes rather than technical hacking. Targeted Brands Analysis of the dataset revealed recurring references to several major consumer platforms and payment services. The most commonly referenced brands included Amazon, PayPal, Apple, eBay, Walmart, Best Buy, delivery platforms, and digital payment services. These platforms share characteristics that make them attractive targets: Large transaction volumes that allow fraudulent refunds to blend into normal activity Customer-friendly refund policies designed to maintain satisfaction High-value consumer goods or financial transactions that increase potential profits for fraud actors Lowering the Entry Barrier to Refund Fraud One of the most important insights from our research is how refund fraud techniques are increasingly being standardized and sold as digital products. By packaging operational knowledge into tutorials and step-by-step guides, underground sellers enable individuals with little technical expertise or prior experience to participate in refund fraud schemes. Unlike many other forms of cybercrime, refund fraud typically requires minimal technical knowledge. Instead, it operates in a gray area between legitimate consumer behavior (such as returning damaged goods) and deliberate deception. Individuals who purchase these tutorials may initially view the activity as harmless, but exposure to these communities and methods can gradually draw them deeper into more organized and malicious forms of fraud. Another trend observed is the emergence of “refund fraud as a service.” In this model, a customer purchases a product and collaborates with threat actors who handle the refund manipulation process, with both parties splitting the profits. The incentives are clear on both sides. “Customers” receive guidance and coaching on how to exploit refund policies, while fraudsters can scale their operations without investing significant time in each case. Instead, they simply apply the techniques they have already mastered. This model mirrors trends seen across other cybercrime markets, where tools such as ransomware kits, phishing kits, and malware builders are sold as services. In the case of refund fraud, however, the product being sold is procedural knowledge - guidance on how to manipulate refund systems and exploit operational gaps in retail platforms. Although refund fraud does not require advanced technical capabilities, its impact on businesses can rival that of more technically sophisticated cybercrimes such as malware campaigns or ransomware attacks. The growing underground market for refund fraud tutorials and services demonstrates how modern cybercrime increasingly targets not only technological vulnerabilities but also the business logic and operational processes of online platforms. For e-commerce companies, retailers, payment providers, and any organization operating digital services, these cases highlight the importance of maintaining strong threat intelligence capabilities. Understanding emerging fraud techniques allows organizations to stay ahead of evolving threats, educate employees and service providers, and develop more effective fraud prevention strategies. Sponsored and written by Flare.

Crypto e-commerce platform Bitrefill accuses North Korea of stealing 18,500 purchase records North Korean hackers targeted cryptocurrency e-commerce platform Bitrefill during an attack on March 1, according to a post-mortem from the company published Tuesday. In a lengthy statement, Bitrefill said hackers allegedly tied to North Korea’s Lazarus group accessed around 18,500 purchase records that contained email addresses, crypto payment addresses and metadata including IP addresses. Bitrefill is designed to allow people to live off of cryptocurrency, enabling users to buy digital gift cards or pay bills online with it. The company has partnerships with Amazon, Doordash, Apple, Uber, Walmart and more. The company first announced issues on March 1 and eventually was forced to take systems offline when it was discovered to be a security breach. The company restored its website and app on March 5, intimating at the time that North Korea was responsible for the attack. Law enforcement and cybersecurity experts assisted in the investigation. In its post-mortem, the company confirmed that based on the tactics, malware, IP addresses, email addresses and blockchain activity, the incident was attributed to hackers connected to North Korea's Lazarus Group. “The initial access originated through a compromised employee laptop, from which a legacy credential was exfiltrated,” the company said. “That credential provided access to a snapshot containing production secrets. From there, the attackers were able to escalate their access to our broader infrastructure, including parts of our database and certain cryptocurrency wallets.” The breach was discovered because they noticed suspicious purchasing patterns with certain suppliers — tipping off that their gift card stock and supply lines were being exploited. Some company cryptocurrency wallets were drained and funds were transferred to hacker-controlled wallets. The statement does not say how much was taken and whether those funds were clawed back. Bitrefill did not respond to requests for comment. The company said it plans to absorb the losses through its operational capital. Bitrefill claims the hackers were not after their entire customer database and conducted “a limited number of queries consistent with probing to understand what there was to steal, including cryptocurrency and Bitrefill gift card inventory.” In November, the Justice Department said it was able to seize more than $15 million that had been stolen by Lazarus during four separate incidents in 2023. Lazarus is allegedly organized within the North Korean Reconnaissance General Bureau and has stolen billions worth of cryptocurrency over the last nine years, with blockchain monitoring firm Chainalysis saying hacking groups connected to North Korea’s government stole $1.3 billion worth of cryptocurrency across 47 incidents in 2024. Chainalysis reported that more than $2 billion worth of crypto was taken by North Korean hackers last year. Much of the figure is attributed to the $1.5 billion theft from Dubai-based platform Bybit in February, South Korean officials also accused North Korea of stealing $30 million worth of cryptocurrency from crypto platform Upbit. As seen in the attack on Bitrefill, North Korean actors have typically focused on stealing private keys or secrets that grant a person full control over digital assets. Since Chainalysis began tracking the figures in 2022, North Korea has stolen $6.8 billion in crypto. The United Nations said in 2024 that it is tracking dozens of incidents over a five-year period that have netted North Korea about $3 billion. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

A phishing site impersonating the newly-launched Pudgy World browser game is targeting crypto users with a technique that goes well beyond a convincing logo and matching color scheme. Pudgy World is a free-to-play browser game built around the Pudgy Penguins NFT brand. Players explore a virtual world, customize penguin avatars, and complete quests. But some features are tied to digital collectibles and in-game items stored in cryptocurrency wallets. That means the official game sometimes asks players to connect a crypto wallet to verify ownership of items or unlock additional features. The phishing site abuses that step: When a visitor selects their wallet on this fake site, it shows what appears to be that wallet’s own unlock screen. To the user, it looks for all the world like the real crypto wallet software they already trust. “Connect your wallet to get started” The Pudgy Penguins brand has had an extraordinary few months. The penguin NFT project, revived by CEO Luca Netz after he acquired it in 2022, has steadily built one of the most convincing crossover stories in Web3: physical plush toys on Walmart and Target shelves, a mobile game called Pudgy Party that crossed a million downloads, and a browser-based game called Pudgy World that went live on 10 March 2026 to immediate viral attention. The official game asks players to connect a crypto wallet to get started. That text: “Connect your wallet to get started” is now appearing, verbatim, on a site that has nothing to do with Pudgy Penguins. The domain in question is pudgypengu-gamegifts[.]live. It is not affiliated with Igloo Inc., the company behind Pudgy Penguins, in any way. The site reproduces the official game’s icy background artwork, the Pudgy Penguins logo, and the brand’s characteristic blue-and-white color palette with enough fidelity that a user arriving during the excitement of a new game launch would have no obvious reason for suspicion. Eleven wallets, eleven convincing forgeries Clicking the CONNECT button opens a dark-themed pop-up window built to resemble the Reown WalletConnect connection kit—the open-source library that the real Pudgy World site uses to handle wallet connections. The modal even displays the “reown” and “Manual Kit” tab labels at the top, matching the genuine component. Inside is a list of supported wallets: MetaMask (marked “RECOMMENDED”), Trust Wallet, Coinbase Wallet, Ledger, Trezor Wallet, Phantom Wallet, Rabby Wallet, OKX Wallet, Magic Eden, Solflare, and Uniswap Wallet. The attack becomes technically interesting at the next step. Selecting a software wallet does not redirect the user to another page or open an external site. Instead, the page renders an overlay designed to look like the wallet’s actual browser extension unlock screen. The overlay appears at the edge of the browser viewport right where a real extension popup would appear. Hardware wallet flows behave differently. Selecting Trezor Wallet opens a center-screen dialog mimicking the Trezor Connect interface, rather than a corner overlay. In both cases, the result is that the user believes they are looking at their own installed software, when they are in fact looking at a webpage element controlled by the attacker. The forgery sits exactly where your real extension would For every browser extension wallet on the list, the phishing site renders an unlock screen built to match the real extension’s own visual identity, with the correct logo, color scheme, button layout, and wording. The screenshots below show the forgeries alongside the genuine extensions. The differences are not visible to someone who is not looking for them. Hardware wallet users are not exempt, and the targeting of Trezor is particularly telling. Trezor devices are typically owned by people who have been in crypto long enough to invest in dedicated security hardware. In other words, users likely holding higher-value accounts. Selecting Trezor Wallet on the phishing site triggers a dialog that closely mimics the Trezor Connect bridge interface. At the same time, the browser displays a native USB device permission prompt—the operating system’s own dialog, triggered by a WebUSB API call—reading “pudgypengu-gamegifts.live wants to connect.” The prompt says “No compatible devices found” if no Trezor is plugged in, but the sequence is designed to look like a genuine hardware handshake. A user who plugs in their Trezor at this point and approves the USB permission has granted the phishing site access to the device bridge. For those without a device to hand, the dialog offers another option: “Use an alternative connection method.” That path is likely where the most damage is done. A user who cannot get the hardware flow to work and falls back to a manual option is one step away from being asked to type in their seed phrase, the master key to everything in their wallet, directly into a field the attacker controls. The page that plays dead for researchers The phishing page is more cautious than it first appears. Embedded in the site is an obfuscated JavaScript loader, its real contents compressed and hidden behind multiple layers of encoding, that performs a series of checks before doing anything visible. First, it tests whether the browser is being driven by an automated tool of the kind security researchers and sandboxes use to analyse suspicious pages in bulk. If it detects one, it quietly stops and the page appears clean. Next, it reads the graphics hardware identifier to determine whether it is running inside a virtual machine, which is another common analysis environment. Only once it is satisfied that a real user is present does it request a second, larger payload from the attacker’s server. That payload contains the code responsible for credential theft. Even that request contains a safeguard. If the server response is smaller than 500 KB (the kind of placeholder response a security vendor might serve to a known malicious domain), the loader discards it and does nothing. The practical consequence of all this is that automated scanning tools are likely to rate the initial page as benign, because on their infrastructure, it behaves like one. The malicious functionality never loads unless the attacker’s server decides the visitor is worth targeting. Why this campaign targets Pudgy players The timing seems to be deliberate. Pudgy World launched on March 10, 2026, and the phishing campaign appears to have been active around the same window. New players arriving at the game for the first time are walking through a Web3 onboarding flow they have never experienced before. The legitimate “connect your wallet” step on the official site teaches users that this behaviour is normal. The phishing site then exploits that expectation before experience can challenge it. The range of wallets targeted is also significant. The campaign leaves almost no wallet blind spot. Whether the victim holds Ethereum, Solana, or multi-chain assets, there is a convincing forgery waiting for them. Building 11 wallet-specific UI forgeries is not a trivial undertaking. It points either to a well-resourced threat actor or, more likely, to the reuse of a commercial phishing kit built for precisely this class of attack. What to do if you may have been affected Crypto phishing campaigns have long relied on fake airdrops and fake MetaMask pages. This campaign stands out for how precisely it imitates a wallet’s unlock screen, placing the prompt exactly where a real extension pop-up would appear and exploiting users’ muscle memory. The attack also piggybacks on Pudgy World’s launch. As Web3 products reach wider audiences, they attract attackers targeting users unfamiliar with wallet security. One rule still holds: a website can never display your real browser extension unlock screen. If you entered your MetaMask, Coinbase Wallet, or any other software wallet password on this site, change your password immediately by unlocking the extension normally and going to Settings. Consider transferring assets to a new wallet address whose seed phrase has never been used on any website. If you approved the USB device permission prompt for Trezor, disconnect your device and review your Trezor Suite connection history. A WebUSB connection alone does not expose your seed phrase, but it can allow a malicious page to communicate with the bridge. Revoke the permission in your browser’s site settings immediately. Bookmark the official Pudgy Penguins site (pudgypenguins.com) and the official game URL. Navigate to it directly from that bookmark, never from a link in Discord, Twitter, or a direct message. Install a browser extension that flags known phishing domains before you interact with them. Malwarebytes Browser Guard will block this domain. Remind yourself of this rule: your wallet’s unlock screen always appears in the bar at the very top of the window, not inside the page itself. Any page that appears to show you your wallet’s password prompt inside the page content is a phishing site. Indicators of Compromise (IOCs) Domains pudgypengu-gamegifts[.]live

On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive software that forces the user’s network to relay Internet traffic for others, traffic that is often tied to cybercrime activity such as advertising fraud and account takeovers. Superbox bills itself as an affordable way for households to stream all of the television and movie content they could possibly want, without the hassle of monthly subscription fees — for a one-time payment of nearly $400. “Tired of confusing cable bills and hidden fees?,” Superbox’s website asks in a recent blog post titled, “Cheap Cable TV for Low Income: Watch TV, No Monthly Bills.” “Real cheap cable TV for low income solutions does exist,” the blog continues. “This guide breaks down the best alternatives to stop overpaying, from free over-the-air options to one-time purchase devices that eliminate monthly bills.” Superbox claims that watching a stream of movies, TV shows, and sporting events won’t violate U.S. copyright law. “SuperBox is just like any other Android TV box on the market, we can not control what software customers will use,” the company’s website maintains. “And you won’t encounter a law issue unless uploading, downloading, or broadcasting content to a large group.” There is nothing illegal about the sale or use of the Superbox itself, which can be used strictly as a way to stream content at providers where users already have a paid subscription. But that is not why people are shelling out $400 for these machines. The only way to watch those 2,200+ channels for free with a Superbox is to install several apps made for the device that enable them to stream this content. Superbox’s homepage includes a prominent message stating the company does “not sell access to or preinstall any apps that bypass paywalls or provide access to unauthorized content.” The company explains that they merely provide the hardware, while customers choose which apps to install. “We only sell the hardware device,” the notice states. “Customers must use official apps and licensed services; unauthorized use may violate copyright law.” Superbox is technically correct here, except for maybe the part about how customers must use official apps and licensed services: Before the Superbox can stream those thousands of channels, users must configure the device to update itself, and the first step involves ripping out Google’s official Play store and replacing it with something called the “App Store” or “Blue TV Store.” Superbox does this because the device does not use the official Google-certified Android TV system, and its apps will not load otherwise. Only after the Google Play store has been supplanted by this unofficial App Store do the various movie and video streaming apps that are built specifically for the Superbox appear available for download (again, outside of Google’s app ecosystem). Experts say while these Android streaming boxes generally do what they advertise — enabling buyers to stream video content that would normally require a paid subscription — the apps that enable the streaming also ensnare the user’s Internet connection in a distributed residential proxy network that uses the devices to relay traffic from others. Ashley is a senior solutions engineer at Censys, a cyber intelligence company that indexes Internet-connected devices, services and hosts. Ashley requested that only her first name be used in this story. In a recent video interview, Ashley showed off several Superbox models that Censys was studying in the malware lab — including one purchased off the shelf at BestBuy. “I’m sure a lot of people are thinking, ‘Hey, how bad could it be if it’s for sale at the big box stores?'” she said. “But the more I looked, things got weirder and weirder.” Ashley said she found the Superbox devices immediately contacted a server at the Chinese instant messaging service Tencent QQ, as well as a residential proxy service called Grass IO. GET GRASSED Also known as getgrass[.]io, Grass says it is “a decentralized network that allows users to earn rewards by sharing their unused Internet bandwidth with AI labs and other companies.” “Buyers seek unused internet bandwidth to access a more diverse range of IP addresses, which enables them to see certain websites from a retail perspective,” the Grass website explains. “By utilizing your unused internet bandwidth, they can conduct market research, or perform tasks like web scraping to train AI.” Reached via Twitter/X, Grass founder Andrej Radonjic told KrebsOnSecurity he’d never heard of a Superbox, and that Grass has no affiliation with the device maker. “It looks like these boxes are distributing an unethical proxy network which people are using to try to take advantage of Grass,” Radonjic said. “The point of grass is to be an opt-in network. You download the grass app to monetize your unused bandwidth. There are tons of sketchy SDKs out there that hijack people’s bandwidth to help webscraping companies.” Radonjic said Grass has implemented “a robust system to identify network abusers,” and that if it discovers anyone trying to misuse or circumvent its terms of service, the company takes steps to stop it and prevent those users from earning points or rewards. Superbox’s parent company, Super Media Technology Company Ltd., lists its street address as a UPS store in Fountain Valley, Calif. The company did not respond to multiple inquiries. According to this teardown by behindmlm.com, a blog that covers multi-level marketing (MLM) schemes, Grass’s compensation plan is built around “grass points,” which are earned through the use of the Grass app and through app usage by recruited affiliates. Affiliates can earn 5,000 grass points for clocking 100 hours usage of Grass’s app, but they must progress through ten affiliate tiers or ranks before they can redeem their grass points (presumably for some type of cryptocurrency). The 10th or “Titan” tier requires affiliates to accumulate a whopping 50 million grass points, or recruit at least 221 more affiliates. Radonjic said Grass’s system has changed in recent months, and confirmed the company has a referral program where users can earn Grass Uptime Points by contributing their own bandwidth and/or by inviting other users to participate. “Users are not required to participate in the referral program to earn Grass Uptime Points or to receive Grass Tokens,” Radonjic said. “Grass is in the process of phasing out the referral program and has introduced an updated Grass Points model.” A review of the Terms and Conditions page for getgrass[.]io at the Wayback Machine shows Grass’s parent company has changed names at least five times in the course of its two-year existence. Searching the Wayback Machine on getgrass[.]io shows that in June 2023 Grass was owned by a company called Wynd Network. By March 2024, the owner was listed as Lower Tribeca Corp. in the Bahamas. By August 2024, Grass was controlled by a Half Space Labs Limited, and in November 2024 the company was owned by Grass OpCo (BVI) Ltd. Currently, the Grass website says its parent is just Grass OpCo Ltd (no BVI in the name). Radonjic acknowledged that Grass has undergone “a handful of corporate clean-ups over the last couple of years,” but described them as administrative changes that had no operational impact. “These reflect normal early-stage restructuring as the project moved from initial development…into the current structure under the Grass Foundation,” he said. UNBOXING Censys’s Ashley said the phone home to China’s Tencent QQ instant messaging service was the first red flag with the Superbox devices she examined. She also discovered the streaming boxes included powerful network analysis and remote access tools, such as Tcpdump and Netcat. “This thing DNS hijacked my router, did ARP poisoning to the point where things fall off the network so they can assume that IP, and attempted to bypass controls,” she said. “I have root on all of them now, and they actually have a folder called ‘secondstage.’ These devices also have Netcat and Tcpdump on them, and yet they are supposed to be streaming devices.” A quick online search shows various Superbox models and many similar Android streaming devices for sale at a wide range of top retail destinations, including Amazon, BestBuy, Newegg, and Walmart. Newegg.com, for example, currently lists more than three dozen Superbox models. In all cases, the products are sold by third-party merchants on these platforms, but in many instances the fulfillment comes from the e-commerce platform itself. “Newegg is pretty bad now with these devices,” Ashley said. “Ebay is the funniest, because they have Superbox in Spanish — the SuperCaja — which is very popular.” Ashley said Amazon recently cracked down on Android streaming devices branded as Superbox, but that those listings can still be found under the more generic title “modem and router combo” (which may be slightly closer to the truth about the device’s behavior). Superbox doesn’t advertise its products in the conventional sense. Rather, it seems to rely on lesser-known influencers on places like Youtube and TikTok to promote the devices. Meanwhile, Ashley said, Superbox pays those influencers 50 percent of the value of each device they sell. “It’s weird to me because influencer marketing usually caps compensation at 15 percent, and it means they don’t care about the money,” she said. “This is about building their network.” BADBOX As plentiful as the Superbox is on e-commerce sites, it is just one brand in an ocean of no-name Android-based TV boxes available to consumers. While these devices generally do provide buyers with “free” streaming content, they also tend to include factory-installed malware or require the installation of third-party apps that engage the user’s Internet address in advertising fraud. In July 2025, Google filed a “John Doe” lawsuit (PDF) against 25 unidentified defendants dubbed the “BadBox 2.0 Enterprise,” which Google described as a botnet of over ten million Android streaming devices that engaged in advertising fraud. Google said the BADBOX 2.0 botnet, in addition to compromising multiple types of devices prior to purchase, can also infect devices by requiring the download of malicious apps from unofficial marketplaces. Several of the Android streaming devices flagged in Google’s lawsuit are still for sale on top U.S. retail sites. For example, searching for the “X88Pro 10” and the “T95” Android streaming boxes finds both continue to be peddled by Amazon sellers. Google’s lawsuit came on the heels of a June 2025 advisory from the Federal Bureau of Investigation (FBI), which warned that cyber criminals were gaining unauthorized access to home networks by either configuring the products with malicious software prior to the user’s purchase, or infecting the device as it downloads required applications that contain backdoors, usually during the set-up process. “Once these compromised IoT devices are connected to home networks, the infected devices are susceptible to becoming part of the BADBOX 2.0 botnet and residential proxy services known to be used for malicious activity,” the FBI said. The FBI said BADBOX 2.0 was discovered after the original BADBOX campaign was disrupted in 2024. The original BADBOX was identified in 2023, and primarily consisted of Android operating system devices that were compromised with backdoor malware prior to purchase. Riley Kilmer is founder of Spur, a company that tracks residential proxy networks. Kilmer said Badbox 2.0 was used as a distribution platform for IPidea, a China-based entity that is now the world’s largest residential proxy network. Kilmer and others say IPidea is merely a rebrand of 911S5 Proxy, a China-based proxy provider sanctioned last year by the U.S. Department of the Treasury for operating a botnet that helped criminals steal billions of dollars from financial institutions, credit card issuers, and federal lending programs (the U.S. Department of Justice also arrested the alleged owner of 911S5). How are most IPidea customers using the proxy service? According to the proxy detection service Synthient, six of the top ten destinations for IPidea proxies involved traffic that has been linked to either ad fraud or credential stuffing (account takeover attempts). Kilmer said companies like Grass are probably being truthful when they say that some of their customers are companies performing web scraping to train artificial intelligence efforts, because a great deal of content scraping which ultimately benefits AI companies is now leveraging these proxy networks to further obfuscate their aggressive data-slurping activity. By routing this unwelcome traffic through residential IP addresses, Kilmer said, content scraping firms can make it far trickier to filter out. “Web crawling and scraping has always been a thing, but AI made it like a commodity, data that had to be collected,” Kilmer told KrebsOnSecurity. “Everybody wanted to monetize their own data pots, and how they monetize that is different across the board.” SOME FRIENDLY ADVICE Products like Superbox are drawing increased interest from consumers as more popular network television shows and sportscasts migrate to subscription streaming services, and as people begin to realize they’re spending as much or more on streaming services than they previously paid for cable or satellite TV. These streaming devices from no-name technology vendors are another example of the maxim, “If something is free, you are the product,” meaning the company is making money by selling access to and/or information about its users and their data. Superbox owners might counter, “Free? I paid $400 for that device!” But remember: Just because you paid a lot for something doesn’t mean you are done paying for it, or that somehow you are the only one who might be worse off from the transaction. It may be that many Superbox customers don’t care if someone uses their Internet connection to tunnel traffic for ad fraud and account takeovers; for them, it beats paying for multiple streaming services each month. My guess, however, is that quite a few people who buy (or are gifted) these products have little understanding of the bargain they’re making when they plug them into an Internet router. Superbox performs some serious linguistic gymnastics to claim its products don’t violate copyright laws, and that its customers alone are responsible for understanding and observing any local laws on the matter. However, buyer beware: If you’re a resident of the United States, you should know that using these devices for unauthorized streaming violates the Digital Millennium Copyright Act (DMCA), and can incur legal action, fines, and potential warnings and/or suspension of service by your Internet service provider. According to the FBI, there are several signs to look for that may indicate a streaming device you own is malicious, including: -The presence of suspicious marketplaces where apps are downloaded. -Requiring Google Play Protect settings to be disabled. -Generic TV streaming devices advertised as unlocked or capable of accessing free content. -IoT devices advertised from unrecognizable brands. -Android devices that are not Play Protect certified. -Unexplained or suspicious Internet traffic. This explainer from the Electronic Frontier Foundation delves a bit deeper into each of the potential symptoms listed above.

You’ve probably seen it before—a bright, urgent message claiming you’ve qualified for a $750 or $1000 Walmart gift card. All you have to do is answer a few questions. It looks harmless enough. But once you click, you find yourself in a maze of surveys, redirects, and “partner offers”—without ever actually reaching the end and claiming your prize. This so-called “survey” is part of a lead-generation and affiliate marketing scam, designed not to reward you but to harvest your data and push you through ad funnels that make money for others, at the cost of your privacy. What’s really going on? It’s a scam because these pages rarely deliver any real gift card. What they’re after is your personal data. As you move through each step, you’re asked for details like your name, email, phone number, ZIP code and even your home address. In some cases, you’re prompted to share interests such as home repair, debt help, or insurance quotes—each answer helps categorize you for targeted marketing. Even if the page itself doesn’t steal money, that information is still valuable. It can be used to target you with more ads and offers, add you to marketing lists, or personalize follow-up contact. In other words, completing the questionnaire hands over data that can be exploited for profit—even when no gift card ever appears. In some cases, the funnel gets even more specific. For example, if the survey asks you about home projects and you say you’re planning to replace your windows, you might be redirected to what looks like a legitimate home improvement site—often just another form asking for the same details again. The whole thing is designed to keep you filling out more forms, giving up more of your data, to more websites and affiliates. These scams aren’t just annoying time-wasters. They are harvesting your data, eroding your privacy and exposing you to wider risks. Once your details are shared, they can travel far beyond that fake survey. Your information may: Be resold to advertisers and data brokers, who build detailed profiles about your habits, spending, and location. Lead to a surge of spam calls, texts, and phishing emails tailored to your interests. Feed more convincing scams down the line, since criminals can now personalize their lures using real information about you. End up on unregulated marketing lists that circulate for years, keeping your data in play long after you’ve closed the page. That’s the hidden cost of a “free” gift card: each click fuels a network that profits from your identity, not your participation. Why do people fall for it? The hook is simple—free money and easy participation. But this fake Walmart promotion taps into three powerful psychological triggers: The sense of luck: “You’ve been selected!” sounds personal and special. The promise of low effort: Answering a few questions feels harmless. The illusion of credibility: Walmart’s branding lends legitimacy. These scams spread mainly through advertising and malvertising networks—pop-ups, spam emails, social media ads, or sketchy website banners that imitate real promotions. You might spot them alongside news articles or as “sponsored links” that sound too good to be true. Some appear via push notifications or redirects, whisking you from a real website to a fake reward page in seconds. The designs often use official logos, countdown timers, and congratulatory language to make them look like authentic brand campaigns—tricking people into lowering their guard. It’s an easy mental shortcut: “If this was fake, it wouldn’t look so professional.” That’s what these scammers count on—the appearance of legitimacy mixed with urgency and reward. How to protect yourself These gift card offers aren’t just harmless internet fluff—they’re the front door to a sprawling network of data collection and affiliate profiteering. Each click, form, and redirect is designed to extract value from your attention and information, not to reward you. Recognizing these scams early is the best defense. Here’s how to stay safe: Be suspicious of online surveys promising big rewards. Legitimate promotions from major retailers rarely require long questionnaires or partner offers. Never give personal information to unknown pages. If a site asks for your phone number or address for a “free prize,” it’s a red flag. Use browser protection tools. Extensions like Malwarebytes Browser Guard can block known scam domains and malvertising networks before they load. Check the URL carefully. Real Walmart promotions will always come from official domains (like walmart.com or survey.walmart.com), not random URLs with extra words or numbers. Stay alert and skeptical. Online quizzes and reward offers are a favorite bait for scammers. When in doubt – close the tab. Something feel off? Check it before you click. Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly. Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.

Correction: After publishing, Red Hat confirmed that it was a breach of one of its GitLab instances, and not GitHub. Title and story updated. An extortion group calling itself the Crimson Collective claims to have stolen nearly 570GB of compressed data across 28,000 internal development respositories belonging to Red Hat, with the company confirming it was a breach of one of its GitLab instances. This data allegedly includes approximately 800 Customer Engagement Reports (CERs), which can contain sensitive information about a customer's network and platforms. A CER is a consulting document prepared for clients that often contains infrastructure details, configuration data, authentication tokens, and other information that could be abused to breach customer networks. Red Hat confirmed that it suffered a security incident related to its consulting business, but would not verify any of the attacker's claims regarding the stolen GitLab repositories and customer CERs. "Red Hat is aware of reports regarding a security incident related to our consulting business and we have initiated necessary remediation steps," Red Hat told BleepingComputer. "The security and integrity of our systems and the data entrusted to us are our highest priority. At this time, we have no reason to believe the security issue impacts any of our other Red Hat services or products and are highly confident in the integrity of our software supply chain." After publishing our story, Red Hat confirmed that the security incident was a breach of its GitLab instance used solely for Red Hat Consulting on consulting engagements, and not GitHub. While Red Hat did not respond to any further questions about the breach, the hackers told BleepingComputer that the intrusion occurred approximately two weeks ago. They allegedly found authentication tokens, full database URIs, and other private information in Red Hat code and CERs, which they claimed to use to gain access to downstream customer infrastructure. The hacking group also published a complete directory listing of the allegedly stolen GitLab repositories and a list of CERs from 2020 through 2025 on Telegram. The directory listing of CERs include a wide range of sectors and well known organizations such as Bank of America, T-Mobile, AT&T, Fidelity, Kaiser, Mayo Clinic, Walmart, Costco, the U.S. Navy’s Naval Surface Warfare Center, Federal Aviation Administration, the House of Representatives, and many others. If you have any information regarding this incident or any other undisclosed attacks, you can contact us confidentially via Signal at 646-961-3731 or at [email protected]. The hackers stated that they attempted to contact Red Hat with an extortion demand but received no response other than a templated reply instructing them to submit a vulnerability report to their security team. According to them, the created ticket was repeatedly assigned to additional people, including Red Hat's legal and security staff members. BleepingComputer sent Red Hat additional questions, and we will update this story if we receive more information. The same group also claimed responsibility for briefly defacing Nintendo’s topic page last week to include contact information and links to their Telegram channel. Red Hat releases more details Following our story, Red Hat published a "security update" confirming that threat actors gained access to a GitLab instance used by its Consulting division. "We recently detected unauthorized access to a GitLab instance used for internal Red Hat Consulting collaboration in select engagements," reads the Red Hat security update. "Upon detection, we promptly launched a thorough investigation, removed the unauthorized party's access, isolated the instance, and contacted the appropriate authorities. Our investigation, which is ongoing, found that an unauthorized third party had accessed and copied some data from this instance." "We have now implemented additional hardening measures designed to help prevent further access and contain the issue." Red Hat emphasized that the GitLab instance is only used by its consulting division and the breach does not impact other Red Hat products or its supply chain, including software downloaded from official channels. The company confirmed that the instance contained consulting engagement reports (CERs), which may include project specifications, example code snippets, and internal communications related to consulting services. However, Red Hat states that these reports typically do not contain personal information, and none have been found during the investigation. The company is now contacting impacted customers to share further information on what may have been exposed. Separately, GitLab informed BleepingComputer that its platform or accounts were not compromised, emphasizing that the incident only affected Red Hat's self-managed instance of GitLab Community Edition and that customers are responsible for securing these installations. Update 10/2/25: Story updated with correction from Red Hat that it was a GitLab instance that was breached and not a GitHub account. Update 10/2/25: Added information from Red Hat's official statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report