CSRF library
News, alerts & research
One place for timely safety alerts, foundation updates, original investigations, reports, and practical guides.
69 items across CSRF news, safety alerts, research, and guides.
PHP2Shell fix is out: what to do now if your site runs WordPress or other PHP software
PHP2Shell: PHP released fixes for two critical flaws. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today; WordPress updates alone do not fix it.
Read article
PHP2Shell: PHP’s critical security release is scheduled for 10 AM: what site owners should check now
PHP2Shell: PHP has scheduled a critical security release for October 21. Find out who manages your website, ask which PHP version it uses, and have an update plan ready with your host or web administrator.
Read article
WatchOut for "Quantum Financial System" sites that ask for your crypto wallet recovery phrase
A site calling itself the Quantum Financial System offers wallet syncing and help recovering stolen crypto, then asks you to back up your wallet's recovery phrase, so never type that phrase into any website, because anyone who has it can take everything in your wallet.
Read alert
WatchOut for AI trading videos that say your balance is about to expire
A page says a balance in your name expires in minutes unless you watch a video and pay $29.90 for an AI trading program, so close it and never pay to unlock money.
Read alert
WatchOut for fake government job portals that make you share before you apply
Pages pretending to be Ghana Statistical Service, Ghana's civil service and Angola's labour ministry advertise hundreds of jobs, collect your name and phone number, and then tell you to share the link with 15 friends or 5 WhatsApp groups, so only apply through the agency's own official website.
Read alert
WatchOut for investment sites promising fixed daily profits
Sites like Sigma Trading promise that a Rs290 plan pays Rs75 every day for 75 days and add referral bonuses for signing up friends, which is a return no real investment can pay, so do not deposit money or recruit others.
Read alert
Fake "GitHub Setup" download page pushes a suspicious Windows file
A site called gitappsdown[.]pro copies GitHub's look and offers a free "GitHub Setup" download for Windows. The giveaway: it hands you a password-protected file and shows you the password, which GitHub never does. Opening it can put malware on your computer. Download GitHub only from github[.]com.
Read alert
Fake Fiverr payout page asks freelancers for card details
A copy of the Fiverr website tells a freelancer that a buyer has already paid and that the money is waiting. To release it, a support chat that opens by itself asks for bank card details and calls it a one-time identification. The card number, expiry date and security code are collected on a second website. Being paid never requires your card number or security code.
Read alert
A fake Booking hotel page asks you to confirm a reservation and verify your card
A page copying Booking's checkout asks you to verify your card to confirm a hotel reservation. A chat posing as Booking support says your bank may send a confirmation code. That code can approve a payment. Do not enter card details, and never pass a code on.
Read alert
Fake Samsung Brazil pages ask for a PIX fee to release an order or a gift card
A site using Samsung's name asks for your CPF, then shows an order or a cashback balance waiting for you. To release it you must pay a small fee by PIX: R$ 97,00 for a delivery, R$ 7,36 for a gift card. Nothing arrives. Check any order in the shop's own app instead.
Read alert
A fake "we found your iPhone" page asks for the code that unlocks your phone
CSRF reviewed a page on a look-alike domain that imitates Apple's Find My. It shows an animated map and a device named "iPhone 14 Pro" marked Online, then asks for a six-digit "Security Code to view current location on Map" before it asks for any account details. The device and location are fixed in the page and identical for every visitor. The first code entered is always reported as incorrect after it has already been sent, which prompts a second entry. The page then asks for an Apple Account email address and password and redirects to the genuine icloud[.]com. The domain was registered one day before the page was submitted to CSRF.
Read alert
It Said Your iPhone Was Found. Then It Asked for Your Passcode.
A page sent to people who have lost a phone shows a convincing Find My map, then asks for the phone's own passcode before it asks for anything else. We walked through the page in a controlled setup and recorded each step.
Read article
Trump-branded crypto giveaway website promises to double deposits
A website using Trump imagery and the name trumpamerica[.]io claims that people can send cryptocurrency and receive twice as much back. Its instructions tell visitors to send coins to a special address and say the doubled amount will be returned immediately. That is a classic cryptocurrency giveaway warning sign: sending funds does not create a right to receive anything back.
Read alert
A crypto flasher site advertises fake transaction proof
A website at cryptoflasher[.]net advertises a paid tool that claims to create temporary crypto credits, pending transfers, fake wallet balances, and fake blockchain-explorer pages showing a transaction as confirmed. A person could use that false proof to persuade someone to release goods, money, or services before a real payment exists. Verify every crypto payment independently on the correct blockchain before accepting it.
Read alert
Fake Discord verification pages tell you to paste a PowerShell command
A page at discord-eu[.]cfd uses Discord branding and a Cloudflare-style human check. Its pop-up tells visitors to press Win + R, paste text with Ctrl + V, and press Enter. That is not a normal verification step: it can run a hidden PowerShell command on a Windows computer. Close the page and do not paste or run anything.
Read alert
TuntunSahur malware uses nested password-protected ZIPs to deliver an installer
A page at tuntunsahur[.]sbs offers a TuntunSahur malware download. The first ZIP contains an encrypted ZIP, and another file provides its password. The inner archive contains an installer reported to be malicious. Do not download, extract, or run the files. The theme may make this especially appealing to children and young gamers.
Read alert
Cybersecurity Reach Foundation Delivers Workshop for Fundación JUPÁ Educators
CSRF delivered a workshop for Fundación JUPÁ educators covering scam awareness, stolen credentials, ransomware, phishing, artificial intelligence, and cybersecurity career pathways.
Read articleA cloud-storage address does not make a payment or sign-in page safe
A link may show the name of a familiar cloud-storage company such as Amazon, Cloudflare, or Backblaze while displaying a fake delivery, refund, prize, or account page. The storage company may only be hosting the file; it does not mean the offer belongs to the company shown on the page. Do not enter passwords, card details, identity numbers, or verification codes. Open the real organization's app or website yourself instead.
Read alert
Fake Buffalo Couriers pages ask for your ID and card details to pay a delivery fee
A Buffalo Couriers-branded page shows a fake shipment summary and says an R18.99 shipping fee must be confirmed within 48 hours. A confirmation button leads to a second page that requests an ID or passport number, cellphone number, card number, expiry date, and CVV. The pages are hosted on an unrelated address, and the second page's code sends submitted information to an unknown Telegram recipient. Do not enter details or pay through the pages; check deliveries through the courier's official website or app opened independently.
Read alert
Fake e-challan texts may use legal threats to install an Android app
A text claims that an e-challan has been issued and threatens legal action unless a penalty is paid immediately. The message uses a shortened link instead of an official traffic or government address. The submitted report says the link downloads an Android APK described as a Trojan; the file was not available for independent analysis. Do not open the link or install the app. Check fines through the official government or traffic service opened independently.
Read alert
Free game-download sites can expose children to unsafe launchers and files
A site branded SteamUnlocked presents free pre-installed PC games and promotes a separate launcher outside Steam's official store. A polished catalogue, game covers, and an 'official' claim can make the downloads feel safe, but the site and its files are not verified by Steam or the game publishers. Do not download or run unknown launchers or game files. Children should ask a parent or trusted adult before downloading games from an unfamiliar site.
Read alertUnexpected high-salary job emails may impersonate a real recruiter
An email claims to represent an executive search partner and offers a remote operations and executive-support role with a $200,000 compensation package. This example uses a free Gmail address while pointing to a profile associated with a large staffing firm, then asks for an updated résumé. Similar messages may use a lookalike or other unofficial domain that resembles the real firm's address. A familiar company name or real person's profile does not prove that the sender is genuine. Verify the opportunity through the firm's official website and contact details before sharing your résumé or personal information.
Read alert
Fake Tim Hortons prize page asks you to share before you can continue
A page using Tim Hortons branding says the visitor has won a $200 gift card and asks them to share it with multiple groups or friends through Messenger or WhatsApp before continuing. Links shown for people who receive the shared page use unrelated domains, including assaitssapp[.]com and assaibonus[.]com. Do not share the page or enter information on it; verify promotions through the official Tim Hortons app or website opened independently.
Read alert
CSRF Launches Name the Scam Cards for Community Partners
CSRF launched a set of recognition cards that help students, families, and community members put a plain-language name to common scam situations.
Read article
Fake Vrbo booking site looks identical to the real thing
reservation[.]holiday-vrbo[.]com copies Vrbo branding and presents a fake-looking vacation-rental booking flow. It offers a property listing, a “Book now” button, contact fields, a message-to-host form, and a large deposit. The domain is not Vrbo. Do not enter information or pay through this site.
Read alert
Fake Zoom meeting page downloads malware
A page at quickmeetinglink[.]es copies Zoom branding and claims that the latest Zoom Workplace app is required to join a meeting. It directs visitors to download a file before continuing. The downloaded file was flagged as malware. Close the page, delete the file, and open Zoom through its official app or website instead.
Read alert
Kids, students, and gamers: fake itch[.]io game updates can install malware
A GitHub Pages site at jessellis95[.]github[.]io/update/ copies itch[.]io and offers a password-protected ZIP as a game update for Windows and macOS. The archive contains malware, not a game. Its macOS instructions tell you to paste a remote command into Terminal and enter your computer password; the Windows download contains an obfuscated executable package. Do not download, extract, run, or follow instructions from this page.
Read alert
Two Recent LinkNYC Campaigns Delivered More Than Two Million Impressions
Two recent CSRF scam-awareness campaigns on LinkNYC delivered 167,501 plays and 2,106,101 impressions at no media cost.
Read article
Printer support pages can push remote-access tools
A printer-support site using Canon branding shows a printer error, asks visitors to download a driver, and offers several remote-access tools under a support menu. Related subdomains reported under myprinter[.]live use Brother and Canon branding; the same pattern may also impersonate HP. The pages may be trying to persuade visitors to give an unfamiliar person access to their computer.
Read alert
A Zoom-branded meeting page can deliver a ScreenConnect installer through a fake Microsoft Store
The observed page uses Zoom Workplace branding inside an S3-hosted imitation of a Microsoft Store listing. Its install flow presents a plug-in or update pretext and initiates a download of ScreenConnect[.]ClientSetup[.]msi from pivotalequipmentllc2[.]screenconnect[.]com. The infrastructure and delivery sequence are inconsistent with a normal Zoom meeting workflow.
Read alert
Fake Signal support messages can ask for recovery keys
A message pretending to be Signal support claims that an account is at risk and asks the recipient to click Accept and provide a recovery key. This is a scam warning: never share a recovery key, registration code, verification code, password, or other account secret in response to an unexpected message.
Read alert![WatchOut graphic highlighting the unusual vwww- prefix and [.]co ending in the defanged address vwww-roblox[.]co.](https://scamarchive.org/images/alerts/fake-roblox-lookalike-domain-vwww-roblox-co.webp)
Lookalike game sites can steal player information
A website using the address vwww-roblox[.]co uses Roblox's name with an unusual vwww- prefix and a different domain ending. Lookalike game sites can be used to trick players into entering passwords, verification codes, or payment details. Do not sign in through a link sent in a chat, video, ad, or game message.
Read alert
WatchOut Launches as a Shareable Scam-Alert Service
WatchOut launched in August 2026 as a free alert feed that helps people see scams going around and share practical warnings with others.
Read article
The Fake Nike Careers Site That Tried to Steal Facebook Logins
A convincing Nike job-site clone used a fake Facebook sign-in to target people looking for work.
Read articleA phishing campaign impersonating the Canadian government shows signs of preparing German government lures
A CSRF investigation mapped a phishing email impersonating the Government of Canada and Service Canada. The Canadian redirect chain is now offline, but the same GitHub account uploaded a logo belonging to Germany's Federal Motor Transport Authority (KBA) on 2026-08-07. This suggests preparation for a possible German pivot; no live German phishing page has been confirmed. CSRF reported the GitHub account to GitHub.
Read alert![It Looked Like Zillow. It Wasn't: Inside the zillowofficial[.]com Investment Scam](/investigations/zillowofficial/figure-7.png)
It Looked Like Zillow. It Wasn't: Inside the zillowofficial[.]com Investment Scam
A passive OSINT investigation found that zillowofficial[.]com impersonated Zillow while presenting an investment-style platform and sharing a technical structure with similar domains.
Read articleA suspected Nike recruitment impersonation site uses a Facebook-style login
A reported recruitment-themed website at nikerecruits[.]com appears to use Nike branding and presents a Facebook-style sign-in page. The combination may be intended to trick visitors into entering account credentials. This is an initial warning based on the reported page appearance and requires review before publication.
Read alertA suspected Zillow impersonation site may lead to a task scam
A reported website uses Zillow branding while presenting an agent or in-house tester program. Its FAQ describes daily order sets, negative balances on premium tasks, and topping up an account before work can continue. A separate domain is reported as the support destination. These are strong warning signs associated with task scams and impersonation, but this alert does not establish who operates the sites or whether Zillow was involved.
Read alert
The Government Health-Card Email That Looked Safe to Scanners
A fake Government of Canada health-card email hid its scam page behind a fake security check, sending scanners and researchers to the real canada.ca.
Read article
CSRF Rebuilds Its Google Ad Grant Programme to Promote Free Scam Checks
In July 2026, CSRF rebuilt its Google Ad Grant campaigns to direct people to free scam-checking, email-checking, and scam-reporting resources.
Read article
Port 445 Attacks from Three Indonesian IPs: Findings and Analysis
A T-Pot honeypot logged three Indonesian IP addresses scanning port 445 roughly 80,000 times; OSINT review found residential-proxy signals and exposed MikroTik infrastructure.
Read article
IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner: Inside the New Shai-Hulud npm Worm
A report on a Shai-Hulud npm worm variant that targeted the TanStack ecosystem, harvested credentials, spread through developer environments, and planted destructive persistence.
Read articleA Business's Guide to Agentic AI Adoption
A beginner-friendly guide to adopting agentic AI responsibly, including safe use, onboarding, permission boundaries, and tool evaluation.
Read articleA Business's Guide to Agentic AI Adoption
A beginner-friendly guide to adopting agentic AI responsibly, including safe use, onboarding, permission boundaries, and tool evaluation.
Read articleL.A.Y.E.R.S. OPSEC Framework
A practical six-step OPSEC guide for investigators, researchers, and anyone who needs to reduce exposure while working online.
Read articleL.A.Y.E.R.S. OPSEC Framework
A practical six-step OPSEC guide for investigators, researchers, and anyone who needs to reduce exposure while working online.
Read article
LinkNYC Tax-Scam Campaign Reaches 800K+ Impressions
A tax-season awareness run on New York City kiosks turned a common refund-scam lure into a public warning and reached more than 800,000 impressions.
Read article
OpenClaw Risk Report: High Risk
A review of OpenClaw's autonomous capabilities, local-machine access, reported issues, prompt-injection exposure, and safer deployment practices.
Read article
Fake Meetup Messages Are Stealing Bank Details From Event Organizers
Messages sent through real Meetup accounts used a look-alike link and a fake security screen to lead event organizers to a page asking for bank and card details.
Read article![ALERT: SpiderFoot Scam Resurfaced on spiderrfoot[.]com](/images/investigations/spiderfoot-screenshot.png)
ALERT: SpiderFoot Scam Resurfaced on spiderrfoot[.]com
A deceptive SpiderFoot distribution scheme resurfaced on spiderrfoot[.]com, showing how users can be misled when an open-source project has no official website.
Read article![Rixav[.]sbs: A Crypto Wallet Phishing Site](/images/evidence/ev-1775096407945.png)
Rixav[.]sbs: A Crypto Wallet Phishing Site
rixav[.]sbs impersonates a wallet recovery service to trick users into entering their seed phrases and private keys. This report documents how the scam works, what the site does with your credentials, and why any wallet that touched it should be considered compromised.
Read article
Evofince: Fake Licenses, Template Infrastructure, and a Phantom Crypto Exchange
This investigation analyzes evofince[.]com, a cryptocurrency trading platform that presents itself as a high-volume digital asset exchange. Despite claims of regulatory licensing and years of operational history, domain records show the website was only registered in January 2026.
Read article
FineretCreditUnion.com: Credit Union Using Recycled Scam Infrastructure
A website claiming to be a legitimate credit union appears to be part of a template-based financial scam network designed to collect personal information and solicit fraudulent loan payments.
Read articleSpiderfoot.org: Google Search Mislabels an Unofficial SpiderFoot Site
An unofficial website appearing in search results for the SpiderFoot OSINT tool may be misleading users into downloading software through untrusted channels. Despite the site itself stating it is not affiliated with the official project, search engine AI summaries identify it as the legitimate source
Read article
Introducing Our New Mascot: Cyber
We are super excited to introduce our new mascot, Cyber. Cyber will be undertaking many roles here at the Cybersecurity Reach Foundation, but most importantly, he will be identifying scams and figh...
Read article
Scam Search Party 2: Baruch ISACA Edition
We just wrapped up our second Scam Search Party with the Baruch ISACA Student Group and we had an amazing turnout. The room was packed, the energy was great, and everyone came ready to investigate,...
Read article
Our New LinkNYC Campaign - ScamArchive
We’re thrilled to announce the launch of our latest LinkNYC campaign for The Scam Archive, bringing cybersecurity awareness directly to the streets of New York City. At the Cybersecurity Reach Foun...
Read article
Inside the Cybersecurity Reach Foundation’s First Scam Search Party
On October 12th, we hosted our very first Scam Search Party, bringing together both technical and non-technical participants to collaboratively investigate a real scam submitted to the Cybersecurit...
Read article
Launching Scam Archive – Real Scams, Plainly Explained
We’re proud to announce the launch of Scam Archive, a free platform built to help everyone recognize scams — with real examples, plain explanations, and family-friendly tips. For too long, scammers...
Read article
One Year of Impact – Cybersecurity Reach Foundation
🎉 One Year. One Mission. One Million Reached. Today, we celebrate 1 year of the Cybersecurity Reach Foundation! It’s been a year of protecting people, raising awareness, and building a safer digita...
Read article
Launching CyberScout – Your Free Cybersecurity Advisor
We’re incredibly proud to announce the launch of CyberScout, a completely free cybersecurity advisor available right on WhatsApp. CyberScout is here to be your personal cyber guardian — ready to he...
Read article
Digital Fallout: Capture the Flag at Baruch College
⚡ Digital Fallout: Defend the Campus March 27, 2025 — Baruch College This week, we had the pleasure of hosting Digital Fallout: Capture the Flag, a hands-on cybersecurity competition in collaborati...
Read article
Navigating the Abyss – A Darkweb Workshop at Baruch College
🕳️ Navigating the Abyss – A Darkweb Workshop March 19, 2025 — Baruch College We had an incredible time collaborating with the Baruch ISACA Student Group for our latest workshop: Navigating the Abys...
Read article
Breaking into Cybersecurity at Baruch College
Breaking into Cybersecurity 🔐 February 25, 2025 — Baruch College We had an incredible time at Baruch College hosting Breaking into Cybersecurity, an interactive workshop presented in partnership wi...
Read article
Partnering with Baruch ISACA to Empower Future Cybersecurity Leaders
Partnering with Baruch ISACA 🎓 We’re thrilled to share that the Cybersecurity Reach Foundation is partnering with Baruch ISACA to bring a new wave of cybersecurity events and workshops to the Baruc...
Read article
🤝 Partnering with NordVPN to Strengthen Cybersecurity
A New Partnership We’re thrilled to share that NordVPN, a global leader in online privacy and security, has partnered with us at the Cybersecurity Reach Foundation. 🤝 What this means - NordVPN is h...
Read article
🚀 Launching InboxSpotter – Spot Email Scams Instantly
Launching InboxSpotter We’re incredibly proud to announce the launch of InboxSpotter, a free tool that helps anyone instantly identify email scams. 🚀 Our team has been working tirelessly to create...
Read article
🎉 Reaching 1,000 Instagram Followers – Thank You!
We Hit 1,000 Followers! 🎉 We’re beyond excited to celebrate a major milestone — 1,000 Instagram followers! What started as a small community passionate about cybersecurity awareness has grown into...
Read article
🎉 A Huge Milestone: 500 Instagram Followers!
We Did It! We’ve reached 500 Instagram followers! 🎉 Thank you to every single one of you for being part of our community. Your engagement and support are what drive us forward in our mission to emp...
Read articleSafety alerts are maintained in our shared alert feed. For one-tap sharing and free email alerts, visit WatchOut.