THREATNOIR
Subscribe
Back to Feed
MalwareMar 24, 2026

@TMobile 2 related malware source urls: https://tmobile-support[.]com/files/T-Mobile-Security-Pat...

T-Mobile impersonation domains distribute malware disguised as security patches.

Read at source

Summary

Researchers identified malicious URLs spoofing T-Mobile's support domain distributing trojanized files disguised as security patches and updates. The malware samples have been uploaded to analysis platforms, indicating an active campaign leveraging brand impersonation and social engineering to distribute malicious payloads to users seeking legitimate security updates.

Indicators of Compromise

  • domain — tmobile-support.com
  • url — https://tmobile-support.com/files/T-Mobile-Security-Patch.zip
  • url — https://tmobile-support.com/files/TM_SecPatch_v2.1.4.exe