A Dangerous New Threat for Coin Master Players
Mobile gamers are facing a major security threat this month. Cybersecurity researchers have issued an urgent warning about a highly sophisticated phishing campaign targeting players of the hit game Coin Master. The scam lures victims with the promise of an unprecedented 100,000 free spins, a haul that would normally cost hundreds of real-world dollars.
First detected in early October 2026, the campaign has quickly spread across social media platforms like TikTok, Facebook, and Discord. Security analysts say the speed of the rollout indicates a well-coordinated effort by cybercriminals looking to hijack player accounts and steal sensitive personal data.
How the 100,000 Spins Scam Works
Coin Master relies heavily on a slot-machine mechanic where players use spins to win coins, attack rival villages, and defend their own. Because spins are the primary currency of progress, they are always in high demand. Developer Moon Active regularly shares legitimate free spin links that give out 25 or 50 spins at a time. This new scam exploits that routine, but on a massive scale.
“The sheer size of the offer is the first big warning sign,” says Sarah Jenkins, a lead mobile threat analyst at cybersecurity firm VeloSec. “Moon Active never gives away hundreds of thousands of spins at once. But to a casual player who sees a sponsored post on their feed, it looks like a dream event.”
The scam begins with a link posted on social media or sent via direct message. Clicking the link takes the user to a fraudulent website. These fake portals are designed to look identical to official Coin Master or Moon Active web pages, complete with high-quality graphics, moving animations, and even fake user comments claiming the offer is real.
The Traps Behind the Click
Once a player lands on the malicious site, they are prompted to enter their game username or connect their Facebook account to “verify” their identity and claim the spins. Because Coin Master accounts are tied directly to Facebook to save progress, this is where the real danger lies.
If a player inputs their Facebook credentials into the fake login box, the hackers instantly capture them. Within minutes, the victim is locked out of their Facebook account. The attackers then use these hijacked profiles to target the victim’s real-life friends, spreading the phishing link further or attempting to extract money through direct messages.
In more severe cases, the fraudulent sites ask for a small “verification fee” of one dollar to process the massive spin transfer. This trick is designed to harvest credit card details. Some sites even prompt Android users to download a custom utility file, claiming it is a “spin generator.” In reality, the file contains aggressive spyware capable of tracking keystrokes and stealing banking passwords.
How to Spot the Phishing Sites
- Check the URL carefully: Official links will always lead to moonactive.com or verified game store pages. Fake sites use slight misspellings or completely unrelated domain names.
- Look at the numbers: If an offer promises thousands of free spins, it is a scam. Moon Active’s real rewards rarely exceed 100 spins per link.
- Never download external apps: Do not install third-party files or APKs from web browsers to get game rewards. Only update the game through the official Google Play Store or Apple App Store.
- Watch for password prompts: Legitimate spin links do not require you to re-type your Facebook password on an external website.
Staying Safe in the Village
Moon Active has previously urged players to remain vigilant and only trust links shared on verified social media pages that carry a blue checkmark. If you suspect you have already entered your details on a fake site, security experts recommend changing your Facebook password immediately and enabling two-factor authentication.
The current phishing wave shows no signs of slowing down as October progresses. By understanding how these scammers operate and keeping a skeptical eye on offers that seem too good to be true, players can keep their accounts, and their hard-earned villages, safe from digital raiders.
About the Author
