Scammers Evolve Tactics, Targeting Platforms and Personalities for Maximum Impact
Scammers are becoming more sophisticated, tailoring their attacks to specific platforms and leveraging the likeness of popular figures like MrBeast to increase success rates.
Scammers are no longer employing a one-size-fits-all approach to their malicious activities. New research from Malwarebytes reveals a significant evolution in tactics, with criminals strategically choosing platforms where their scams are most likely to succeed. This data, gathered between April 15 and July 14, 2026, indicates a deliberate shift from broad, untargeted campaigns to highly personalized and platform-specific operations.
Analysis shows distinct patterns in scam delivery. For instance, toll scams, often disguised as unpaid toll notices threatening fines or license suspension, overwhelmingly arrive via email or text messages. In contrast, romance scams predominantly initiate contact through social media platforms, where personal connections are more readily established. This strategic segmentation allows scammers to maximize engagement and exploit user behavior unique to each channel.
The research also highlights the increasing reliance on the web as the primary vector for scams, despite the proliferation of social media and messaging apps. Malwarebytes reports blocking approximately 500,000 phishing websites daily, underscoring the web's persistent role as a gateway for fraudulent activities. Email and SMS follow as the next most common delivery methods, demonstrating a multi-channel approach to reach potential victims.
In a notable shift, the popular YouTuber "MrBeast" (Jimmy Donaldson) has surpassed figures like Elon Musk and Donald Trump as the most impersonated personality in scams. MrBeast's likeness is used in roughly 30% of impersonation scams, ranging from fake cryptocurrency giveaways to fraudulent transfer fee schemes. The familiarity and trust associated with such public figures lower the guard of potential victims, making scam messages appear more credible.
Scammers are also meticulously timing their campaigns to coincide with peak user activity. For Americans on the East Coast, lunchtime, particularly around noon ET on Fridays, represents a "golden hour" for scam texts. This period sees a significant surge in fraudulent messages, with Friday being the busiest day of the week, experiencing approximately 50% more scam texts than earlier in the week.
Big brands are also prime targets for impersonation due to their widespread recognition and user base. Malwarebytes identified Google, Microsoft, Apple, Roblox, and Amazon as the top five most impersonated brands. Scammers leverage these familiar names to lend legitimacy to fake offers, bogus account alerts, and other deceptive schemes.
The gaming sector is emerging as a particularly lucrative area for scammers. Platforms like Roblox, Steam, Discord, and Minecraft are frequently targeted. Malwarebytes Scam Guard data indicates that nearly half of all gaming scams pose a "high-severity risk," with the potential to cause financial losses of $1,000 or more. Roblox and Steam, in particular, saw significant spikes in scam activity in mid-2026.
To combat these evolving threats, users are advised to exercise caution with unsolicited communications, avoid clicking suspicious links, and verify information through official channels. Employing security tools like browser extensions that block scam sites and mobile security products can provide an additional layer of defense against these increasingly sophisticated and targeted scams.