Scammers rented BuzzFeed's reputation to impersonate Malwarebytes support

The phone line is the durable asset here, while the page itself is disposable. Malwarebytes says the number in the listing had already run under McAfee's and Norton's names ^[5], which puts three impersonated security brands behind one callback number ^[15]. The cost of a brand swap is a form, a description, and a logo the operator does not own ^[13]. That inverts the usual takedown economics. The listing is consumable; the line is the fixed cost worth defending.

That makes the number the indicator a defender would want. The post does not carry it. Malwarebytes did not publish the number, the listing URL, or a takedown time. Instead, it offered to check numbers that readers send in ^[9]. The pivot that would let a help desk or fraud team match an inbound "Malwarebytes support" call against a known scam line stays on the vendor's side.

Domain-reputation controls have nothing to bite on. Malwarebytes lists the platform's own domain name and security certificate among the things a fake listing borrows, alongside its familiar design and the assumption that listings were reviewed ^[13]. A page served from a large publisher's certificate looks exactly like the publisher.

The cheapest available tell is placement. The support listing sat in BuzzFeed's Quizzes section ^[2], and Malwarebytes' own guidance is to treat unexpected numbers as untrusted, particularly when they surface in an unrelated category ^[10]. Its read of the intent is that callers get social-engineered into granting remote access to their devices ^[4], and that the advertised product is beside the point, because the goal is the call, the download, or the card details ^[14].

Weigh the evidence for what it is: one listing, self-reported by the brand being impersonated, without a victim count or a dated timeline ^[1][9]. The prevalence context is the vendor's own survey, where 47 percent of people said they encountered scams on social media at least weekly and 36 percent said the same of buying-and-selling platforms ^[6][7], an 11-point gap between the two channels ^[16]. Those figures count encounters, not losses.

What lifts this above a one-off is the reuse ^[15]. An operator who rotates host platforms and brand identities while keeping the same voice line is running a standing tech support fraud desk, and the moderation stack Malwarebytes describes (automated detection, seller controls, user reports, brand-protection programs, moderation teams) is built to pull pages down, while scammers rotate names, images, accounts, numbers and links faster than reviewers move ^[8]. Pages are cheap to lose. Malwarebytes' framing is the useful part: a trusted platform hosting a trusted brand name does not produce trust or verification ^[11].