Fake Bitrefill checkouts collect crypto from buyers who arrive through search results

The operators are counting their traffic. The fake checkout hands visitors back to a second domain in the same family, and the link it uses carries a parameter naming a search engine ^[8]. Malwarebytes takes that as the operators tagging arrivals by source ^[8]. The same page runs commercial analytics software, the kind an e-commerce team installs to see how many carts get abandoned ^[9]. Malwarebytes says its presence suggests the operators want to measure and improve the share of visitors who complete a payment ^[10]. It describes the campaigns as run as businesses, measured and tuned like any other funnel ^[20].

Credential phishing, as Malwarebytes lays it out, has to clear four things before the attacker sees money: steal a password, get past 2FA, log in without tripping a fraud check, and turn account access into cash ^[11]. Plenty of scams fall apart somewhere in there ^[11]. The fake checkout needs one action from the victim, which is sending the coins ^[12]. Three of the four points where the scheme could have broken are gone ^[1]. Crypto transfers generally cannot be reversed or charged back ^[13].

On most retail sites a demand for cryptocurrency looks wrong. Bitrefill genuinely accepts it, so on a copy of its checkout the request fits the situation ^[14]. The page asks for an email address for order updates and links to terms of service and a privacy policy ^[19]. The payment screen shows a QR code, an address marked for one-time use, the amount converted into the chosen coin, and a countdown giving just under an hour ^[15]. Unique addresses, expiry timers and currency conversion are all normal in real crypto checkouts, and the only meaningful difference is the address the money goes to ^[16]. On the site Malwarebytes examined, the visible error was inconsistent currency symbols on the amount selector ^[17].

Malwarebytes says the distribution does not appear to rely on email ^[7]. It also does not say whether the search placement was bought as advertising or earned by ranking, and I would expect those to need different responses: a paid slot sits in a search engine's abuse queue, while an organic listing has to be pulled at the registrar or the host ^[6].