T-Mobile Rewards Phishing: Fake Expiry Scam Texts

This report details an ongoing T‑Mobile ‘Rewards’ SMS phishing campaign (monitored since early May 2026) that leverages urgency and fabricated balances to trick recipients into visiting fraudulent sites; Malwarebytes observed over 1,000 message templates and at least 81 rotating domains. The phishing pages attempt to collect credentials, personal and payment information, and verification codes; the report provides defanged IoCs, risk impact (identity/financial and potential business account compromise), and mitigation advice including reporting suspicious texts to 7726.