Threads' ubiquitous Mr Beast spam is part of a massive crypto scam network

The deluge of low-res screenshots continue to evade moderation enforcement. Screenshots via Threads If you've spent any time on Meta's Threads app in the last year, then you've likely seen what I like to call "the Mr Beast reply guys:" A spam account replies to a popular post with a nonsensical phrase and a low-quality screenshot of the British newspaper The Times featuring a fictitious story about Mr Beast. There's usually a second, seemingly random, image — often a bouquet of flowers with an iPhone. The formula has some minor variations, but these posts are absolutely everywhere. Like so much spam on social media, it's part of a massive crypto scam. According to an analysis from Zach Edwards, a staff security researcher at Infoblox, the person or group behind these accounts is running more than 10,000 malicious "crypto casino" websites. Engadget identified dozens of accounts posting Mr Beast reply spam on Threads, some of which have racked up hundreds of thousands of views over the last 30 days. All of the accounts were promoting websites that Edwards identified as being part of the same network. While scammers are constantly using new tactics to lure people into financial schemes, according to both Edwards and Mark Beare, head of consumer at scam detection platform Malwarebytes, the way these posts have played out on Threads is unusual. For one, the posts don't contain obvious links to the scams they're promoting. Even the strange phrases that appear alongside the images, like "pencil shavings curl like thoughts," don't read like the typical get-rich-quick crypto scam content many social media users frequently encounter. But look closely at the faked screenshots and you'll find that every low-res photo of the YouTuber is accompanied by a fake news story claiming that he's launching a new "project" or "promotion" and giving away money if you visit a sketchy website. Edwards believes the accounts' bizarre posting habits are an effort to both evade detection by Meta's systems and stress-test the types of posts most likely to gain visibility. "This network is a monster for A/B testing," he told Engadget, referring to their ability to try different variations of the same content to determine which is more effective. "These threat actors have potentially figured out that their domains are being picked up too quickly when they embed them in the post, so they've tried this weird process where you bury the domain and you make the person sort of feel like it's a scavenger hunt. If you're promoting just an image and there's an obscure URL that's not even super prominent, a lot of these AI [detection] systems may miss it." The Mr Beast reply scammers seem to have also discovered how to optimize their spam for the unique quirks of the Threads algorithm. Replying to popular posts is a proven strategy for gaining visibility on Threads; Meta has said that half of the views on Threads come from replies. The nonsensical phrases and low-res screenshots, which often require you to enlarge the image to view it properly, are likely drawing more users to linger on the posts. All that could end up being a recipe for receiving some algorithmic amplification. "They're trying to feed an algorithm, and each platform has a different algorithm," says Mark Beare, head of consumer at scam detection platform Malwarebytes. While Beare said he wasn't familiar with this particular network of crypto scammers, he wasn't surprised by their seeming fixation on Mr Beast. Mr Beast, he says, is now one of the most ubiquitous public figures in scams, with mentions of the YouTuber outnumbering other frequently-cited celebrities like Elon Musk. Many of these scam websites (like the one above) are running simple deposit scams, says Edwards. The sites promise some kind of "free reward" or sign-up bonus in order to entice people to make accounts. Once they've signed up and gotten their promotional credits — one website Engadget visited labeled it "free money" — they're presented with a bevy of online slot machines and other simple games. The websites claim users can withdraw and deposit funds at any time, enticing users into giving up credit card information or connecting crypto wallets. After entering a supposed promo code from the Mr Beast spam into one of these sites, I was informed that I was "among the winners of our $10M Bonus Event promotion" and had won $3,000. Withdrawing these winnings would only require a wallet address or credit card number. That fits the pattern described by Edwards. "It's usually: sign up for your deposit bonus, and then it starts to tell you fake returns, and then they're encouraging you to deposit more money," he explains. "They're not really looking for long cons, they're looking for quick stakes." It's not clear how many people might be falling for these scams. Analysis of the more than 10,000 domains collected by Edwards shows that many of these supposed crypto casinos are seeing very little traffic. But o

Threads' ubiquitous Mr Beast spam is part of a massive crypto scam network

Key takeaways

More in tech