CTM360 identified more than 1,000 incidents in a gift-card scam campaign spread through social media ads on Nov. 4, 2026.
People who tap on malicious ads built around celebrity endorsements land on fake reward pages that show copied brand logos, made-up participant counts, running countdown clocks, and invented testimonials. Sponsored social media ads and viral giveaway posts distribute these pages. The scam borrows the names of PlayStation, Sephora, SHEIN, Walmart, Amazon, and Google Play, plus celebrities such as MrBeast and Alix Earle.
After a scripted visual animation that pretends to generate codes in the background, a partially masked string such as XXXX-XXXX-7F3A-XXXX shows up. When the user chooses a gift card amount, a deceptive Security Check or Human Verification gate appears next. CTM360 calls this verification step Trap 10.
The process cycles through quizzes, promotional offers, and surveys, then pushes unwanted third-party app or browser extension installs and mobile subscriptions charged through local carriers. The system marks finished tasks as incomplete and never sends a gift card. CTM360 ran every flow and delivered no reward.
Fake pages send users through affiliate tracking URLs that carry parameters including offer_id and aff_id, linking sign-ups to threat actor affiliate accounts. The actors collect commissions when victims submit mobile numbers and complete PIN/OTP verification—a one-time passcode sent to a phone—for subscriptions. This setup runs on volume and conversion instead of credential theft.
The system stays highly modular, so actors can swap which brands, celebrities, and domain names appear without rebuilding the underlying scam engine. People face personal information exposure, surprise mobile billing charges, and spam. Companies whose brands get impersonated suffer serious harm to brand reputation.
Join the discussion