MrBeast-themed reply spam has kept turning up on Threads for over a year. The posts push a crypto scam network, and some of the accounts behind them drew hundreds of thousands of views over the last 30 days.
Engadget identified dozens of accounts in the pattern. Zach Edwards said the person or group running them also controls more than 10,000 malicious crypto casino websites.
Zach Edwards on the network
Edwards, a staff security researcher at Infoblox, said the same accounts were promoting websites tied to the same network. He described the operation as A/B testing, saying, "This network is a monster for A/B testing".
He also said the operators appear to be hiding the domains inside the post itself instead of putting them in plain view. "These threat actors have potentially figured out that their domains are being picked up too quickly when they embed them in the post, so they've tried this weird process where you bury the domain and you make the person sort of feel like it's a scavenger hunt," he said.
Threads and reply visibility
The posts reply to popular threads with a nonsensical phrase and a low-quality screenshot of The Times showing a fictitious story about MrBeast. Some posts also include a second image, such as a bouquet of flowers with an iPhone, and the screenshots are low enough resolution that users often have to enlarge them to read them.
The setup keeps the scam visually messy while avoiding obvious links to the sites it promotes. The fake screenshots make MrBeast look tied to a new project or giveaway, then steer users toward a sketchy website without using the kind of direct bait that moderation systems often catch first.
Mark Beare on the tactic
Mark Beare, head of consumer at Malwarebytes, said the pattern appears built to work with platform ranking systems. "They're trying to feed an algorithm, and each platform has a different algorithm," he said.
Meta has said that half of the views on Threads come from replies, which helps explain why the spam keeps returning in that part of the app. For users, the practical response is simple: treat reply threads with the same caution as direct messages when a post tries to funnel attention through a strange image, a buried link, or a too-neat giveaway story about MrBeast.
