A surge in fraudulent gift card campaigns is currently targeting consumers by weaponizing the reputations of major global retailers. Security researchers at CTM360 have identified over 1,000 distinct incidents where threat actors impersonate well-known brands, including Amazon, Walmart, Sephora, SHEIN, and PlayStation. These campaigns are designed to exploit consumer trust through sophisticated social engineering rather than traditional credential theft.
The scam typically begins on social media platforms, where attackers distribute sponsored advertisements and viral posts promising free rewards. To lend these claims legitimacy, the campaigns frequently utilize fabricated endorsements from high-profile celebrities and influencers. Once a user interacts with these ads, they are redirected to a fraudulent portal designed to mimic the aesthetic and branding of the targeted company.
These portals employ several psychological tactics to maintain the illusion of a legitimate giveaway. Visitors are presented with live countdown timers, fake participant counts, and testimonials from purported winners. After a user selects a gift card value, the site displays a scripted animation that simulates the generation of a reward code. A partially masked code is then shown to the user, creating a false sense of urgency and expectation that the prize is imminent.
To access the full code, victims are forced to complete a mandatory human verification step. CTM360 describes this as a deceptive gate that prevents the delivery of any actual reward. Instead of verifying the user's identity, the process redirects victims into an endless loop of third-party activities. These include filling out surveys, installing unwanted browser extensions or applications, and signing up for recurring mobile subscriptions through carrier-billing mechanisms.
The underlying infrastructure of these scams is highly modular, allowing attackers to rapidly swap out brand logos, celebrity names, and domain names without reconfiguring the core system. This flexibility enables the operators to maintain a high volume of activity while minimizing the risk of detection. The researchers note that the campaign operates on an affiliate monetization model, where the threat actors earn commissions for every user who completes a survey or subscribes to a service.
Technical analysis reveals that the scam portals utilize affiliate tracking URLs containing specific parameters, such as offer IDs, to link victim activity back to the attacker’s account. Because the goal is to drive conversions rather than steal login credentials, the threat actors rely on volume to generate revenue. In every instance tested by the security team, no gift card was ever delivered to the victim.
The consequences for users caught in these loops include the exposure of personal information, unexpected financial charges on mobile phone bills, and an increase in unsolicited spam. For the organizations being impersonated, the campaigns represent a significant risk to brand equity and consumer trust.
CTM360 emphasizes that this activity reflects a broader trend in the threat landscape, where attackers are increasingly leveraging brand impersonation as a primary mechanism for large-scale affiliate fraud. The researchers advise that organizations must actively monitor their external digital footprint to identify and mitigate these unauthorized uses of their brand identity before they can cause widespread consumer harm.
