The most popular video game in the world is Fortnite[1]—which makes Fortnite scams a potentially very profitable endeavor. And while that point may seem obvious, the extent of Fortnite fakes on the web, along with how convincingly they mimic their inspirations, may still surprise you.
Fortnite opportunists have plagued the internet since the game’s launch; WIRED has previously looked at the scourge of fake app downloads[2] connected to the game’s controversial Android launch[3]. But a new report from security firm ZeroFox lays bare just how broadly these scams have proliferated across social media, YouTube, and thousands of domains.
“Once we started digging into it, we uncovered a lot of stuff,” says Zack Allen, director of threat operations at ZeroFox.
By the numbers, that “stuff” comprises over 4,770 live domains dedicated to Fortnite scams; 1,390 YouTube videos advertising malicious links with combined views in the millions; and hundreds of links on social media every day that lead to fraudulent destinations.
The fraud generally centers around V-Bucks, the in-game currency that that players use to purchase various items and upgrades. V-Bucks cost real money; Fortnite is free to play, but reportedly raked in a billion dollars[4] in revenue by May for Epic Games, a significant chunk of which came from in-app purchases. Scammers typically try to lure people who’d rather not pay up, offering “V-Cash generators” and fake coupons in exchange for personal information, credit card numbers, or ad clicks that generate revenue for the crooks.
“The biggest thing that surprised us was the professionalism that went into some of these websites, where they would design some of these V-Bucks sites with a lot of skill,” says Allen. “They