The 10,000-Spin Trap
Coin Master is a global juggernaut. With over 100 million downloads, the mobile game mixes slot machine mechanics with light strategy. Players build villages, raid enemies, and, most importantly, spin the wheel. But those spins run out fast. Buying more costs real money. That is where scammers found their golden opportunity.
Security researchers are warning players about an aggressive new phishing campaign. This one is highly targeted. It promises a massive reward: 10,000 free spins. To an active player, that is the ultimate jackpot. To cybercriminals, it is the perfect bait.
The scam usually begins on social media. Fraudsters set up fake Facebook groups, run sponsored ads, or compromise high-profile accounts to spread the word. They post links to what they claim is an official Moon Active giveaway. Moon Active is the developer behind Coin Master.
Once a player clicks the link, they do not land on the official game page. Instead, they are redirected to a convincing replica.
How the Attack Works
“The level of polish on these sites is alarming,” says David Garcia, a lead threat analyst at security firm NetGuard. “They use the correct fonts, the official color scheme, and even high-resolution assets stolen directly from the game’s official marketing materials. It looks completely legitimate.”
Once on the fake site, players are asked to enter their Coin Master username or link their Facebook account to “claim” the 10,000 spins. Because Coin Master heavily relies on Facebook integration for saving progress and playing with friends, this request feels entirely normal to casual gamers.
If a user enters their Facebook credentials, the trap snaps shut. The hackers instantly harvest the login details. They do not just gain access to the game; they take over the victim’s entire Facebook profile. This gives them access to private messages, personal photos, and connected credit cards. They also use the stolen accounts to spread the scam further to the victim’s friend list.
The “Human Verification” Hook
In other cases, the phishing site redirects users to a “human verification” portal. Here, players are told they must complete a few simple tasks to unlock their reward. These tasks usually involve downloading external apps, signing up for premium SMS services, or filling out lengthy surveys that ask for highly sensitive personal data.
“The scammers make money every time someone completes one of these offers,” Garcia explains. “Meanwhile, the player gets absolutely nothing. No spins, no bonuses. Just a compromised device or a bloated phone bill.”
Coin Master’s player base makes it an attractive target. It attracts a highly diverse demographic, including young children and older adults who may not be familiar with modern phishing tactics.
How to Stay Safe
Moon Active has repeatedly stated that they never host giveaways of this scale on external websites. Official free spins are distributed daily through verified channels, usually in batches of 25 to 50 spins, and they open directly within the game app itself.
Security experts recommend several steps to stay safe. First, look closely at the web address. Official links will always point to Moon Active or redirect directly into the Coin Master app. Second, never enter Facebook login details on any site that does not have a verified ‘facebook.com’ URL. Finally, turn on two-factor authentication (2FA) for all social media accounts. It is the single best way to stop hackers even if they manage to steal your password.
If you think you already fell for this scam, act quickly. Change your Facebook password immediately, log out of all active sessions, and check your authorized apps list for any suspicious activity.
