Loading today’s stories
Security1 distinct publisher2 min readPublished
The callback number in the fake listing had already been used in scams impersonating McAfee and Norton. That makes the phone line the operator's durable asset, and the hosting platform is just an interchangeable front.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
Follow any of these and your For You feed starts watching them — no settings page required.
security
The refund scam that asks you to uninstall your antivirus, then writes down which one1 distinct publisher
security
Fake Apple Pay receipt reads a $657 charge aloud through the iPhone's own speech engine1 distinct publisher
security
PavinLoader: the lures keep changing, the MSBuild stage does not1 distinct publisher
security
OpenAI's 13-17 tier turns teen AI safety into an age-assurance problem1 distinct publisher
The phone line is the durable asset here, while the page itself is disposable. Malwarebytes says the number in the listing had already run under McAfee's and Norton's names [5], which puts three impersonated security brands behind one callback number [13]. The cost of a brand swap is a form, a description, and a logo the operator does not own [9]. That inverts the usual takedown economics. The listing is consumable; the line is the fixed cost worth defending.
That makes the number the indicator a defender would want. The post does not carry it. Malwarebytes did not publish the number, the listing URL, or a takedown time. Instead, it offered to check numbers that readers send in [12]. The pivot that would let a help desk or fraud team match an inbound "Malwarebytes support" call against a known scam line stays on the vendor's side.
Domain-reputation controls have nothing to bite on. Malwarebytes lists the platform's own domain name and security certificate among the things a fake listing borrows, alongside its familiar design and the assumption that listings were reviewed [9]. A page served from a large publisher's certificate looks exactly like the publisher.
The cheapest available tell is placement. The support listing sat in BuzzFeed's Quizzes section [2], and Malwarebytes' own guidance is to treat unexpected numbers as untrusted, particularly when they surface in an unrelated category [15]. Its read of the intent is that callers get social-engineered into granting remote access to their devices [4], and that the advertised product is beside the point, because the goal is the call, the download, or the card details [10].
Weigh the evidence for what it is: one listing, self-reported by the brand being impersonated, without a victim count or a dated timeline [1][12]. The prevalence context is the vendor's own survey, where 47 percent of people said they encountered scams on social media at least weekly and 36 percent said the same of buying-and-selling platforms [6][7], an 11-point gap between the two channels [14]. Those figures count encounters, not losses.
What lifts this above a one-off is the reuse [13]. An operator who rotates host platforms and brand identities while keeping the same voice line is running a standing tech support fraud desk, and the moderation stack Malwarebytes describes (automated detection, seller controls, user reports, brand-protection programs, moderation teams) is built to pull pages down, while scammers rotate names, images, accounts, numbers and links faster than reviewers move [11]. Pages are cheap to lose. Malwarebytes' framing is the useful part: a trusted platform hosting a trusted brand name does not produce trust or verification [16].
Ranked by verification strength, evidence, and original report placement.
Malwarebytes reported that it recently found a listing on BuzzFeed from someone pretending to be Malwarebytes Support.
The example listing appeared in the "Quizzes" section of BuzzFeed.
Based on the phone number, Malwarebytes suspects the people behind the listing are trying to draw callers into a tech support scam.
Malwarebytes says the scammer may use social engineering to persuade victims to grant remote access to their devices.
The phone number in the BuzzFeed listing has also been used in similar scams impersonating McAfee and Norton.
Malwarebytes research found that 47% of people encountered scams on social media at least once a week.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 27, 2026
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Single self-interested account with no publishable indicators
Everything rests on one blog post by the impersonated vendor. The core observation (a fake support listing in BuzzFeed's Quizzes section) and the most consequential claim (the same number used against McAfee and Norton) are asserted without the number, the listing URL, a screenshot detail, or a takedown date, and with no platform or third-party corroboration. The mechanics and moderation sections are argued rather than measured, and the only numbers cited are the vendor's own unmethodologised survey figures.
One documented instance plus vendor prevalence survey
There is a concrete disclosed instance and a claimed pattern spanning three impersonated brands via one phone line, which is more than a hypothetical. But scale is unmeasured: no count of listings, no listing lifetime, no reach, no victim or loss figures, and no platform-side data. The only quantities are the vendor's 47%/36% encounter percentages, which describe general scam exposure on hosted platforms rather than uptake of this specific technique.
Framing runs slightly ahead of the disclosed evidence
The source itself is measured and hedged ('we suspect', 'may use'), and its structural argument about borrowed credibility is reasonable. The overstatement sits in the cluster framing: 'rented BuzzFeed's reputation' and 'the phone line is the operator's durable asset' are inferences built on one unpublished number and a single sighting, with no platform comment, no campaign scale, and no victim outcomes. The vendor's promotion of Scam Guard alongside a withheld indicator nudges the gap positive rather than neutral.
Impersonated vendor also sells the recommended remedy
The sole publisher is both the impersonated brand and the commercial beneficiary. The post routes readers to a vendor number-checking service instead of publishing the indicator, cites the vendor's own unmethodologised prevalence research, and closes with placements for Malwarebytes Scam Guard, Premium Security, and the 24/7 support desk. Brand-defence and lead-generation motives are both present and undisclosed as conflicts.
Plausible and internally consistent, but unverifiable
The mechanism described is well-established and the account is internally coherent and appropriately hedged, which supports moderate confidence in the general pattern. Confidence in the specific case is capped by the single-source record, the absence of any publishable indicator or platform confirmation, and the publisher's commercial stake in the conclusion.