A Huge Scam Targeting Kids With Roblox and Fortnite ‘Offers’ Has Been Hiding in Plain Sight

·11 min·1 clip

Thousands of government and university websites have been hijacked to push Fortnite and Roblox scams targeting kids.

The episode details security researcher Zach Edwards' three-year investigation into website hijackings pushing scams targeting children. Edwards, a senior manager at Human Security, discovered thousands of compromised websites belonging to U.S. government agencies, universities, and professional organizations. Attackers exploit vulnerabilities in content management systems to upload malicious PDF files called 'poison PDFs' packed with search terms related to Fortnite skins, Roblox currency, and popular movies. These PDFs appear in search results and redirect users through multiple websites to scam landing pages designed specifically for children. The landing pages use 'locker pages' that promise free game currency in exchange for personal details, app downloads, or survey completion. Edwards' research links all this activity to advertising company CPA Build, whose servers receive calls from every compromised website. CPA Build operates as a content-locking network where affiliates earn money by getting people to complete offers. The company's website shows an affiliate structure with tiers named managers, devils, demons, wizards, masters, and knights. Despite CPA Build's terms prohibiting fraud and claims of daily fraud checks, Edwards' findings show rampant ongoing abuse. The New York State Department of Financial Services removed poison PDFs after being contacted, and Edwards alerted CISA to over 50 compromised websites including national laboratories. Gaming companies Epic Games and Roblox confirm these are scams and prohibit such third-party services. Security firm Kela has observed discussions about CPA Build on cybercrime forums where users seek approval methods and accounts. Some poison PDFs also distribute malware, with Edwards noting they sometimes appear after negative news articles about China. The episode concludes with statements from AWS about investigating the infrastructure and continued warnings about these persistent scams.

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from What's New