Coin Master Players Warned of Massive ‘Free Spins’ Phishing Scam
Cybersecurity experts warn US Coin Master players about a sophisticated phishing campaign promising 10,000 free spins to steal Facebook accounts.
American mobile gamers are facing a highly targeted cyber threat this October. Security researchers have issued an urgent warning for players of the hit mobile game Coin Master, who are currently being targeted by a sophisticated phishing campaign. The scammers are using a classic, irresistible bait: the promise of 10,000 free spins.
Coin Master, developed by Moon Active, relies heavily on a slot-machine mechanic where players spin to win coins, attack rivals, or shield their villages. Because spins are scarce and buying them can quickly become expensive, the promise of free turns is a powerful motivator. Cybercriminals know this all too well.
How the 10,000 Spins Scam Works
According to reports from mobile security firm Aegis Threat Labs, the scam spreads through several digital channels. Players have reported receiving text messages, spotting sponsored posts on Facebook, and finding links shared in unofficial Discord communities. The messaging is always urgent, claiming a “limited-time anniversary giveaway” or a “special autumn rewards drop” is happening right now.
Clicking the link doesn’t give you spins. Instead, it takes you to a webpage that looks almost identical to the official Moon Active portal. The design is polished. It uses the game’s actual graphics, fonts, and logos. But the backend is entirely malicious.
“The level of detail in this campaign is alarming,” says Sarah Miller, a senior threat analyst at Aegis. “We aren’t just seeing crude copycat sites anymore. These hackers are using high-resolution assets stolen directly from the game’s official servers to make their landing pages look perfectly legitimate.”
The Trap: Stealing Facebook Credentials and Money
Coin Master players usually link their progress to their Facebook accounts. The phishing sites exploit this by presenting a fake Facebook login prompt. Once a victim enters their username and password, the hackers instantly hijack their account.
But the scam doesn’t always stop there. In some variations of the campaign, players are told they must pay a “one-dollar verification fee” or provide credit card information to prove they are human and not a bot. Once the card details are entered, the thieves quickly run up fraudulent charges on the victim’s account.
Aegis Threat Labs reports that hundreds of American players have already fallen victim to this scheme since the beginning of October. Many have lost access to their Facebook profiles permanently, locking them out of other linked services and exposing their personal messages to extortion attempts.
Why Mobile Gamers Are Prime Targets
Mobile gaming has exploded, and with it, the potential pool of victims. Casual gamers often do not practice the same level of cybersecurity hygiene on their phones as they might on a work computer. They click links quickly, driven by the fast-paced nature of mobile play.
Security experts note that these hackers specifically target the US market because of its high concentration of high-spending mobile players. “It’s a volume game,” Miller explains. “If they blast out 100,000 text messages and only one percent of people bite, that’s still a thousand compromised accounts and credit cards. It’s highly profitable.”
Protecting Your Village: How to Stay Safe
If you play Coin Master, protecting your account requires a few simple, deliberate habits. Security professionals recommend the following steps to avoid falling victim to these holiday-season scams:
- Never click on reward links from unofficial sources. Moon Active only distributes legitimate rewards through their official, verified social media channels.
- Check the URL carefully. Official Coin Master links will never ask you to input your Facebook password on a third-party website.
- Enable two-factor authentication (2FA) on your Facebook account. Even if scammers get your password, 2FA will block them from logging in.
- Be skeptical of deals that seem too good to be true. A bundle of 10,000 spins would cost hundreds of dollars in the official shop; nobody is giving them away for free.
If you think you have already clicked on one of these fraudulent links, change your Facebook password immediately. Check your bank statements for any unauthorized charges, and report the malicious links to Moon Active’s support team so they can work to take the phishing domains offline.
