Coin Master Players Warned Over Viral TikTok and Discord Phishing Scam
Security experts warn Coin Master players about a viral October 2026 phishing scam offering thousands of fake spins via TikTok and Discord links.
A dangerous new phishing campaign is targeting Coin Master players worldwide. Cybersecurity researchers issued an urgent warning this week as fraudulent links continue to spread rapidly across TikTok and Discord. The scam, which gained massive momentum in early October 2026, exploits players with the promise of thousands of free bonus spins. Instead of rewards, it delivers compromised accounts and stolen personal data.
Coin Master, developed by Moon Active, remains one of the most profitable mobile games on the market. Its core gameplay relies entirely on slot-machine spins. Players use these spins to win coins, raid rival villages, and build their bases. Because daily spins are limited, players frequently run out. This design creates a high demand for extra spins, making players prime targets for opportunistic cybercriminals.
How the Scam Spreads on TikTok and Discord
The attackers rely on a mix of social media platforms to reel in victims. On TikTok, short, highly edited videos show players allegedly receiving massive windfalls of 10,000 or 50,000 free spins instantly. Many of these clips use stolen gameplay footage or artificial intelligence to mimic popular gaming influencers. The video descriptions urge viewers to click a link in the bio to claim the same bounty.
On Discord, the approach is more aggressive. Automated bots are hijacking community gaming servers. These bots post unauthorized messages claiming that Moon Active is hosting an anniversary giveaway. Because the messages often appear in trusted server channels, younger players are easily fooled into clicking the links.
The Mechanics of the Trap
Once a user clicks the link, they are redirected to a sophisticated phishing page. The site is designed to look exactly like an official Moon Active portal. To claim the fictitious reward, players are prompted to log in.
Since Coin Master accounts are tied to Facebook to save progress, the scam page displays a cloned Facebook login screen. If a player enters their credentials, the attackers harvest them instantly.
“This is a highly coordinated credential harvesting scheme,” says Sarah Jenkins, a lead threat analyst who tracked the campaign. “The moment you type in your username and password, the hackers take over your actual Facebook account. They can lock you out, message your friends to spread the scam further, and access any linked financial details.”
In some variations of the scam, players are forced to go through a “human verification” process. This requires downloading third-party applications, which are often loaded with malware, or completing surveys that demand highly sensitive personal details.
How to Protect Your Account
Moon Active has repeatedly stated that it never distributes free rewards through third-party websites. Genuine links from the developer will only ever be shared through their verified, blue-checkmarked social media accounts. These legitimate links always open the official Coin Master app directly on your phone rather than redirecting to external login portals.
Security experts recommend the following safety measures:
- Never log into Facebook or any other service through a web page opened via TikTok or Discord.
- Always inspect the website URL. Phishing sites often use domain names that look similar to the real thing but have minor spelling differences.
- Turn on two-factor authentication (2FA) for your Facebook account to prevent hackers from logging in even if they obtain your password.
- Report any videos or messages promoting these fake spin generators immediately to help platform moderators take them down.
If you have already clicked one of these links and entered your details, you must act fast. Change your Facebook password immediately. Go to your Facebook account settings, check active sessions, and log out of any unrecognized devices. Finally, review your linked apps and revoke access to any suspicious third-party programs.
