cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

CTM360 Details Fake Gift Card Scams That Monetize Users Through Affiliate Offers

· Original article ↗

Summary

CTM360 says it identified 1,000+ incidents in fake gift-card campaigns impersonating major brands. The portals use deceptive verification loops to drive surveys, app installs and paid subscriptions; CTM360 says no rewards were delivered in tested flows.

Key points

  • CTM360 reports more than 1,000 incidents linked to a recurring fake gift-card campaign impersonating brands including PlayStation, Sephora, SHEIN, Walmart and Amazon.
  • The lures use social media ads, viral giveaway posts and fabricated celebrity or influencer endorsements to draw users to fraudulent reward portals.
  • Portals simulate gift-card generation with fake progress indicators, testimonials and partially masked codes before presenting a deceptive verification gate.
  • The verification flow redirects users to surveys, promotional offers, app or browser-extension installs, and paid mobile subscriptions; tested flows did not deliver rewards.
  • CTM360 observed affiliate-tracking URLs linking user activity to operators' affiliate accounts; operators can earn commissions when users complete subscription steps involving a phone number and PIN or OTP.
  • Reported risks include personal-information exposure, unexpected mobile charges and spam, as well as misuse of impersonated brands' reputations.

Article Details

Attack Vectors
  • Sponsored social media ads, viral giveaway posts, and fabricated celebrity or influencer endorsements lure users to fraudulent reward portals.
  • The portals impersonate trusted brands and use fake progress animations, masked gift card codes, testimonials, and countdowns to build trust and urgency.
  • A deceptive human-verification step redirects victims to surveys, promotional offers, unwanted application or browser-extension installs, and paid mobile subscriptions.
  • Affiliate tracking links associate victim registrations with operators' affiliate accounts; submitting a mobile number and verifying a PIN or OTP for a subscription can generate commissions.