Free CapCut Pro offer is a trap
A phishing email is circulating that impersonates CapCut and offers a free year of Pro access to push you into clicking a malicious link.
You might see an email with the subject "Good news: You've been gifted 1 year of CapCut Pro 🎯" that appears to come from CapCut and uses its logo and branding in a clean, polished layout. It tells you that you have been gifted a one-year CapCut Pro subscription and urges you to click a button to claim it.
What gives this away is behind the scenes. The sender domain, capcut-pre.win, was only just registered and has no established history as a legitimate sender, which is a major red flag for any business email. While parts of the message can appear technically convincing and may pass some checks, there is no SPF record to back up the sending domain, which means there is less proof that the message was authorised to send on behalf of that domain.
The attacker is trying to get you to click through and trust a fake offer. That can lead to a phishing page that steals your login details, or a site that pushes you to hand over business information or download something you should not. If you engage, you risk exposing accounts and giving an attacker a foothold inside your business systems.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Domain registered ~1 days ago
Where a reply to this message would actually be delivered. When it differs from the visible From address, an unsuspecting reply lands with the attacker instead.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Review whether anyone in your organisation received a CapCut Pro gift email and inspect the sender domain carefully before any action is taken.
- Do not: Click the offer button, download anything, or enter login details after following links from this message.
- Verify: If you genuinely use CapCut, go directly to the official service through your own bookmark or browser search, not through the email.
- Report: Mark the message as phishing in your mail platform and notify your IT provider so it can be blocked for other staff.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine CapCut message looks like, the real sender domain, the real link destination, and where to report a fake.