New Malwarebytes Research Shows Scammers are Tailoring Attacks to Specific Platforms, From Text Toll Scams to Social Media Romance Cons

MrBeast is the most impersonated person, Google is the most impersonated brand, and noon ET on Fridays is the prime time for scam texts

SANTA CLARA, Calif., Sept. 2, 2026 /PRNewswire/ -- Malwarebytes, a global leader in real-time cyber protection, released new research showing how criminals are tailoring specific scam types to the platforms where they are most likely to succeed. Nine in ten toll scams, the fake unpaid-toll messages that threaten fines or license suspension, arrive by email or text, while roughly six in ten romance scams play out on social media.

The findings draw on global data from Malwarebytes threat research systems. Malwarebytes analyzed more than 20 distinct scam types, from tech support and refund scams to sextortion and scareware, and found that each one favors a specific delivery channel.

Read the full report

"Scammers are getting more deliberate about where and when they reach people," said Shahak Shalev, Global Head of Scam and AI Research, Malwarebytes. "Certain scams work better on certain platforms, at certain moments, and scammers repeat what works. Knowing where and when particular scams are most likely to appear can help people recognize them before they engage."

Key findings

• Every scam type has a preferred platform. Fake giveaway scams are far more likely to arrive through a social media feed than by email or text. Half of all IRS scams come by phone call. Job scams favor email, while romance scams mostly arrive through social media, and tech support scams mostly favor phone calls.
• The web is still the biggest hunting ground. Despite the rise of social media and messaging apps, scams are reaching us through the web more than any other platform, followed by email and SMS.
• MrBeast is the most impersonated person, ahead of Elon Musk and Donald Trump. MrBeast appears in roughly 30% of impersonation scams tracked by Malwarebytes, ranging from crypto giveaways to transfer-fee swindles. Elon Musk ranks second and Donald Trump ranks third.
• Noon ET is the "golden hour" for scam texts. Malwarebytes data shows scam text volume peaks at 12 p.m. ET, roughly 874% busier than the quietest hour, 1 a.m. ET.
• Scam texts build all week and peak on Fridays. Volume rises steadily from a low point on Sunday, and by Friday, people receive roughly 50% more fraudulent text messages than they did at the start of the week.
• Scammers favor the world's best-known brands. Based on reports from Malwarebytes users, Google, Microsoft, Apple, Roblox, and Amazon are the five most impersonated brands, in that order. Google's name appears in scam content at least twice as often as Amazon's name.
• Gaming platforms are an increasingly popular target. Roblox, Steam, Discord, and Minecraft were the most impersonated gaming platforms. Roblox saw a 15% spike in scam activity from mid-June to mid-July, and Steam saw a 19% spike over the same period.
• One in five flagged sessions is high-risk. Malwarebytes Scam Guard, which checks messages, phone numbers, texts, social media messages and links against its threat intelligence database, flags approximately one in five analyzed sessions as high-risk, meaning they could lead to a loss of at least $1,000 or other personal harm.

How to spot and stop scams

Malwarebytes recommends the following steps to reduce risk:

• Do not click links or call phone numbers in unsolicited emails, texts, or social media DMs.
• When in doubt, verify a message's legitimacy by going directly to the company's official website and contacting it through official channels. Do not follow sponsored search results to get there, since these can be scams.
• Never share personal details, PINs, passwords, payment information, or verification codes during an unsolicited call. Legitimate companies will not ask for passwords or verification codes over the phone. Hang up and call back using the organization's official phone number.
• Use a browser extension that blocks scam and phishing sites, such as Malwarebytes Browser Guard, which can flag a fake storefront before a user lands on it.
• Install a mobile security product that filters out scam and spam text messages like Malwarebytes Mobile Security alongside comprehensive security with real-time protection for your desktop.
• Check whether a message is legitimate with Malwarebytes Scam Guard, which analyzes any content, message, phone number, text or link against its threat intelligence database and provides information on red flags and recommended next steps.

Methodology

The data in this report comes from Malwarebytes proprietary threat research systems, collected between April 15 and July 14, 2026. All data is anonymized and reflects what Malwarebytes is able to observe through its own infrastructure.

To read more about the latest threats and cyber protection strategies, visit the Malwarebytes blog, or follow us on Bluesky, Facebook, Instagram, LinkedIn, TikTok, Reddit, and X.

About Malwarebytes

Malwarebytes is reimagining security to safeguard devices, data, and people, no matter their location, lifestyle, or means. A global leader in online protection, its suite of award-winning cybersecurity, privacy, and identity solutions empower millions of people worldwide to enjoy their digital lives, free from threats and scams. Built and beloved by experts, Malwarebytes pairs a world-class team of threat researchers with proprietary AI-powered processes to supercharge and refine detections, providing unmatched protection against both known and unknown threats. Living up to its legacy, Malwarebytes continues to offer free tools that have long served as a first line of defense against malware and scams with new options for identity protection and data removal.

Malwarebytes, powerful digital protection that's always by your side.

Learn more: https://www.malwarebytes.com.

Malwarebytes Media Contact: 
Ashley Stewart
Director of Public and Analyst Relations
[email protected]

SOURCE Malwarebytes