C
CapCut
High-fidelity payment confirmation phishing campaigns are impersonating CapCut Pro to harvest credentials and payment data.
Official indicators
What real CapCut messages look like
- Official emails come from @capcut.com or @bytedance.com
- Links lead strictly to capcut.com subdomains
Common spoof patterns
- Emails from unrelated domains like @itdavs.com
- Subject lines referencing 'Pro Payment Confirmation' with random receipt IDs