Connect with us

Technology

Fake Spotify voting scam exposed

Published

on

Fake Spotify voting scam exposed

NEWYou can now listen to Fox News articles!

It started with a simple favor. A friend asked for help voting so he could co-host a major podcast event with Spotify and Google. The first message looked casual. It felt personal. It even had urgency.

“Hey, I need a quick favor,” the message read. “I’m in the running to co-host a major podcast event with Spotify & Google. It’d mean a lot if you could drop a vote for me. Appreciate you!”

I almost clicked. Then I noticed the link. That one detail likely saved multiple accounts. Then came a follow-up text that turned up the pressure: “Please vote for me, I would really appreciate it as the voting will be ending today.”

A final message read, “Thanks, please send me a screenshot after you voted.”

Advertisement

That is when it stopped feeling like a favor and began to feel like a setup. Let’s break down what is really going on here.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

The scam unfolds in stages, starting with a friendly request and escalating to pressure and a demand for a screenshot to confirm you took the bait. (Kurt “CyberGuy” Knutsson)

What this Spotify voting text scam looks like

The message claims someone needs your vote to co-host a podcast event with Spotify and Google. It includes a link that looks official at first glance. But look closely.

The URL reads: spotifyprime-hub.ct.ws

Advertisement

That is not spotify.com. Major companies do not run events on random domains like ct.ws. Scammers register cheap lookalike domains because they are easy to create and hard to notice in a quick scroll. That tiny detail is the first red flag.

What the fake voting page looks like

The site looks clean. It feels polished and official. It even claims to be powered by Google. Then it gives you three options:

  • Continue with Instagram
  • Continue with Email
  • Continue with X

That is when you need to stop. This is not about voting. It is about collecting your login credentials.

ROBINHOOD TEXT SCAM WARNING: DO NOT CALL THIS NUMBER

The fake voting page looks convincing, but the login buttons reveal it is designed to steal your social media credentials. (Kurt “CyberGuy” Knutsson)

What gives this scam away?

If you slow down and look closely, several clear red flags jump out right away.

Advertisement

1. The web address

The domain is wrong. It is not spotify.com or google.com. Instead, it uses a random third-party address. That alone should stop you in your tracks.

2. The urgency

“Voting ends today.” “It would mean a lot.” Scammers rely on emotion and pressure. When you feel rushed, you stop analyzing. That is the goal.

3. The login buttons

A real voting page would not require your Instagram, email or X login. The moment a site asks you to sign in with unrelated platforms, you should assume credential harvesting, which is when scammers trick you into entering your username and password so they can steal your account.

What actually happened to someone who fell for it?

Here is what one victim shared after clicking:

“So I got that Twitter DM from a friend last week. I signed in to vote for him. It didn’t work. Then, a day later, they hacked my account and locked me out before I could change my password. I am still locked out, and it is apparently doing it to other people. Another friend got it from me and also got hacked and is locked out. They are trying to extort him to get access back. And today they tried to get into my bank accounts. It has been miserable.”

Advertisement

This is how fast it spreads. One login becomes 10. Ten becomes hundreds. It turns into a chain reaction.

What the scammers do after you log in?

The process is simple and brutal. First, you enter your username and password. Next, the scammer logs into your account within minutes. Then they change your password and recovery email. After that, they send the same “vote for me” message to everyone in your contacts.

If you reuse passwords, they may try those credentials on email, banking or shopping sites. This is a classic account takeover phishing scam.

Why do scammers ask for a screenshot?

This part is clever. After you “vote,” they ask for proof in the form of a screenshot. Here is why. First, it confirms you completed the login. Second, screenshots can expose usernames, email addresses or other visible details. Third, it keeps you engaged so you do not immediately realize something went wrong. However, the damage usually happens the moment you enter your credentials.

“We’re aware of phishing messages falsely claiming to be associated with Spotify and other brands,” a Spotify spokesperson told CyberGuy. “These messages are not from Spotify, are not connected to any official Spotify event or activity, and are not occurring on the Spotify platform. We encourage people to remain vigilant and avoid clicking on suspicious links.”

Advertisement

Meanwhile, a Google spokesperson pointed us to the company’s online guide for spotting and avoiding scams.

MICROSOFT ‘IMPORTANT MAIL’ EMAIL IS A SCAM: HOW TO SPOT IT

The Spotify logo is displayed on a screen on the floor of the New York Stock Exchange in New York on May 3, 2018. (REUTERS/Brendan McDermid/File Photo)

How to protect yourself from the Spotify voting scam

Now let’s talk prevention.

1. Always check the full URL

Look beyond the brand name in the message. If the domain is not the official company domain, do not click.

Advertisement

2. Slow down when you feel urgency

Scammers manufacture pressure. Real friends can wait.

3. Turn on two-factor authentication (2FA) 

Use app-based two-factor authentication (2FA) whenever possible. It adds a critical barrier.

4. Use strong antivirus software on your devices

Strong antivirus software can block known phishing sites, warn you about suspicious links and help prevent malicious downloads before damage is done. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.

5. Never reuse passwords

Use a password manager to generate unique passwords for every account. Check out the best expert-reviewed password managers of 2026 at Cyberguy.com.

6. Verify with the person directly

If a friend sends something unusual, call or text them separately and ask if they meant to send it.

Advertisement

7. Check login activity regularly

Most social platforms let you review active sessions. If you see a login from an unfamiliar location or device, log out of all sessions immediately.

What to do if you already clicked

  • If you did not click, delete the message and warn your friend.
  • If you did click and enter credentials, act fast.
  • Change the password immediately.
  • Enable two-factor authentication.
  • Review login activity.
  • Change any other accounts that use the same password.

Time matters here, so don’t put this off.

Kurt’s key takeaways

There is no Spotify and Google podcast voting event running on a random ct.ws domain. The entire operation exists to steal social media credentials, hijack accounts and spread further. It looks polished. It feels personal. That is what makes it effective. The next time someone asks you for a quick vote, pause and inspect the link. That small moment of skepticism can prevent days of damage.

If a message came from someone you trust, would you still stop to inspect the link before clicking? Let us know by writing to us at Cyberguy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter. 

Advertisement

Copyright 2026 CyberGuy.com. All rights reserved.

Related Article

YouTube TV billing scam emails are hitting inboxes

Technology

Splatoon Raiders preorders for the Switch 2 are nearly 20 percent off

Published

on

Splatoon Raiders preorders for the Switch 2 are nearly 20 percent off

Nintendo recently announced a new pricing policy, which knocks $10 off the cost of digital versions of future first-party titles exclusive to the Nintendo Switch 2. Splatoon Raiders, for instance, is available for preorder ahead of its July 23rd release for $49.99 digitally or $59.99 for the physical edition. However, Amazon and Walmart are the exception in how they’re pricing preorders for the cartridge version. Right now, you can reserve the upcoming title at both retailers for $49.94, which is a few cents cheaper than the digital version. Raiders isn’t a sequel to Splatoon 3, but rather a spinoff that has similar third-person, paint-splatting gameplay set in new locales.

The same $10 discount is in effect for Yoshi and the Mysterious Book, a side-scrolling adventure with a gorgeous storybook art style that comes out on May 21st. The price of the physical version is $69.99, but Amazon and Walmart are currently offering it for $59.88, which is similar to the digital edition’s price. Given that prices on many tech and gaming-related products are increasing, it’s nice to see notable discounts on physical Switch 2 games. If you’re looking for other gaming deals, we’ve pulled together the best discounts from Amazon’s weeklong Gaming Week sale.

Update, May 1st: Updated price and availability to reflect the fact that Amazon is now matching Walmart’s preorder promotion on both Switch 2 titles.

Continue Reading

Technology

ADT data breach exposes customer information

Published

on

ADT data breach exposes customer information

NEWYou can now listen to Fox News articles!

ADT has confirmed a new data breach, and it comes with a familiar twist. A well-known cybercrime group is reportedly demanding money and threatening to leak data if it does not get paid.

The group behind it, ShinyHunters, says it stole more than 10 million records. ADT has not confirmed that number, but it says attackers accessed customer data.

According to the company, “ADT’s cybersecurity systems detected unauthorized access to a limited set of customer and prospective customer data on April 20, and the company’s response protocols activated immediately, terminating the intrusion, launching a forensic investigation with leading third-party cybersecurity experts, and notifying law enforcement.”

Sign up for my FREE CyberGuy Report

Advertisement
  • Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
  • For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com trusted by millions who watch CyberGuy on TV daily.
  • Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.  

GOOGLE CONFIRMS DATA STOLEN IN BREACH BY KNOWN HACKER GROUP

ADT confirmed a new data breach after hackers claimed they stole millions of records and threatened to leak the data. The company said customer payment information and security systems were not affected. (Kurt “CyberGuy” Knutsson)

What data was exposed in the ADT breach

ADT says, “The investigation confirmed that the information involved was limited to names, phone numbers, and addresses. In a small percentage of cases, dates of birth and the last four digits of Social Security numbers or Tax IDs were included. 

Here is the part that may bring some relief. ADT tells CyberGuy, “Critically, no payment information, including bank accounts or credit cards, was accessed, and customer security systems were not affected or compromised in any way.”

Still, this kind of personal data carries real value. Even without full Social Security numbers, attackers can use it to build convincing scams that feel personal.

How hackers may have accessed ADT systems

This breach may have started with a phone call. ShinyHunters told BleepingComputer it used a voice phishing attack, often called vishing, to compromise an employee’s Okta single sign-on account. The group claims that access allowed it to steal data from ADT’s Salesforce system. ADT has confirmed unauthorized access to customer and prospective customer data, but it has not publicly confirmed that specific attack method. This approach has become more common. Instead of hacking systems directly, attackers target people. One successful interaction can unlock multiple systems at once.

Advertisement

In a statement to CyberGuy, ADT said its response worked as intended.

“ADT’s protocols performed as designed: the breach was identified quickly, the threat was contained, and the scope was limited,” the company said. “ADT has directly notified all impacted individuals and will offer complimentary identity protection services as appropriate. Protecting customers is not just a priority; it is the foundation of what ADT does. The company remains committed to investing in and strengthening the cybersecurity infrastructure that its customers and their families depend on.”

RANSOMWARE ATTACK EXPOSES SOCIAL SECURITY NUMBERS AT MAJOR GAS STATION CHAIN

A sign in front of a suburban home in San Ramon, Calif., indicates the house is secured by an ADT alarm system to prevent burglaries and break-ins.

Why the ADT data breach matters for you

On the surface, this breach may seem limited. No financial data. No system control. That sounds contained. The reality is more complicated.

Advertisement

Names, phone numbers and addresses create a powerful starting point for scams. Add even partial Social Security data, and the risk increases. Criminals can use that information to impersonate companies, reset accounts or trick victims into handing over more sensitive details.

This also raises a bigger issue. Even companies focused on security can become targets. That should change how you think about your own exposure. 

ADT’s history of data breaches

This isn’t the first time ADT has dealt with a data breach. The company disclosed incidents in August and October of 2024 that exposed customer and employee information.

When breaches happen more than once, it raises questions about internal security practices and how attackers keep finding a way in.

At the same time, it highlights a broader trend. Cybercriminal groups like ShinyHunters are focusing on identity systems and employee access instead of traditional hacking methods.

Advertisement

Ways to stay safe after a data breach

After a breach like this, the goal is to reduce how much attackers can do with your information and make yourself a harder target going forward. 

1) Watch for targeted scams

If someone claims to be from a company like ADT, pause before responding. Scammers often use real details to sound convincing. Hang up and contact the company directly using a verified number. 

2) Limit your exposed personal data

Consider using a personal data removal service. These tools help remove your information from data broker sites, which reduces what scammers can find about you online. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.

3) Add identity theft monitoring

Identity theft monitoring can alert you to suspicious activity tied to your name or Social Security number early, which gives you a chance to act before damage spreads. See my tips and best picks on Best Identity Theft Protection at CyberGuy.com.

4) Strengthen your passwords and account security

Use a password manager to create and store strong, unique passwords. If you reused passwords anywhere, especially on email or banking accounts, update them right away to prevent account takeovers. Check out the best expert-reviewed password managers of 2026 at CyberGuy.com.

Advertisement

HEALTHCARE DATA BREACH HITS SYSTEM STORING PATIENT RECORDS

Hackers accessed a limited set of ADT customer and prospective customer data, the company said, including names, phone numbers and addresses. In some cases, partial Social Security or Tax ID information was also exposed. (Matt Cardy/Getty Images)

5) Turn on two-factor authentication

Adding an extra login step, such as two-factor authentication (2FA), makes it much harder for attackers to break into your accounts, even if they have your credentials.

6) Keep your devices protected

Make sure your devices run updated security software. Many modern tools can detect suspicious activity before it turns into a bigger problem.

7) Freeze your credit if sensitive data was exposed

If your Social Security number or even part of it may be involved, consider placing a credit freeze with the major bureaus. This prevents new accounts from being opened in your name without your approval.

Advertisement

8) Review your financial and account activity

Keep an eye on bank accounts, credit cards and important logins for unusual activity. Even small, unfamiliar charges or login alerts can be an early warning sign. 

9) Use strong antivirus protection

Install and maintain strong antivirus software on your devices. It can detect suspicious activity, block malware and help stop threats before they gain access to your data. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.

10) Be cautious with account recovery attempts

Attackers often try to reset your passwords using information they already have. If you get unexpected password reset emails or codes, treat them as a warning sign, not a routine message.

11) Opt for a reliable home security system

While ADT is one of the largest home security companies in the United States, the recent breach of customer information highlights potential vulnerabilities despite the company’s assurance that home security systems were not compromised. There are many other options in the market, whether you prefer a professionally installed system or a do-it-yourself one.

For reference, you can check out my guide on the best home security systems at CyberGuy.com, where I’ve listed four of my favorite options. You might also want to find out if your home insurance offers a discount for installing robust security protection. 

Advertisement

Kurt’s key takeaways

If your data was part of this breach, the risk does not end with the initial incident. In many cases, it is just getting started. You may begin to see more targeted scam calls or emails. Messages might include your name or reference your address to appear legitimate. That level of detail can make even cautious people hesitate. Even if you have never used ADT, this is a reminder of how often personal data circulates behind the scenes. Once it is out there, it can be reused in ways you never expected. The bigger takeaway is simple. Breaches like this are less about a single company and more about how exposed personal data has become across the board.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Should companies like ADT be doing a better job protecting your data, especially after repeated breaches? Let us know by writing to us at CyberGuy.com.

Sign up for my FREE CyberGuy Report

  • Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
  • For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com trusted by millions who watch CyberGuy on TV daily.
  • Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.

Copyright 2026 CyberGuy.com. All rights reserved.

Advertisement
Continue Reading

Technology

Aurzen’s tiny trifold projector is almost 40 percent off right now

Published

on

Aurzen’s tiny trifold projector is almost 40 percent off right now

Not all trifolds are created equal — just ask our own Allison Johnson, who recently spent time with Samsung’s ill-fated Galaxy phone. Aurzen’s Zip projector is the kind of trifold gadget we can fully get behind, though, and it’s currently on sale at Amazon for $259.99 ($140 off). You can also pick it up in several colors directly from Aurzen for the same price, or in the gold shade for a new low of $249.99.

While not nearly as powerful as Anker’s Nebula P1 and other portable projectors we’ve recently tested, the Zip is surprisingly capable despite its small stature and battery-powered operation. The snake-like 720p projector offers up to 100 lumens of brightness — meaning it will work best in dark environments, or in brighter rooms when viewing a smaller image — while its built-in battery should last about 80 minutes based on our real-world testing. That’s not exactly marathon battery life, but it’s easy enough to top off the Zip using a power bank or wall adapter.

In terms of support, the Zip can quickly connect to iPhones via AirPlay and to Android devices over Miracast, Smart View, and similar standards, allowing you to wirelessly mirror everything you can see on your phone. You can use it to watch any movies you’ve downloaded on your device, peruse your social feeds, or get in a quick session with your favorite game. It works in both landscape and portrait orientations, too, and supports Bluetooth, letting you listen privately with headphones or pair it to your favorite speaker.

The biggest downside to the Zip, at least for some folks, is that you won’t be able to use it to watch content from services like Netflix, Hulu, and HBO Max due to copyright restrictions. Aurzen does make a USB-C dongle that allows you to stream DRM-protected content, if you truly can’t get by without watching the latest episode of Euphoria. You’ll have to pay a whopping $109 for the privilege, or find another way.

Continue Reading
Advertisement

Trending