Cybersecurity firm CTM360 has identified a sprawling global scam operation involving more than 1,000 documented incidents of fraudulent gift card giveaways. According to a detailed report released by CTM360, the campaign uses high-volume brand impersonation and modular infrastructure to funnel victims into deceptive “human verification” loops that generate revenue for attackers.
The operation targets consumers by impersonating household names, including PlayStation, Google Play, Sephora, SHEIN, Walmart, and Amazon. To increase the perceived legitimacy of these offers on social media, threat actors have also fabricated endorsements from high-profile celebrities such as MrBeast and Alix Earle.
Modular Infrastructure and Brand Rotation
A defining characteristic of this campaign is its “modular” technical architecture. Analysts at CTM360 found that the underlying code for the scam sites is designed to be highly adaptable. This allows threat actors to rapidly swap out logos, color schemes, and celebrity imagery without restructuring the site’s logic.
This modularity serves two primary purposes: it allows scammers to pivot quickly when one brand becomes a high-priority target for takedown efforts, and it helps the infrastructure evade automated blocklists. By rotating domains and brand assets frequently, the attackers maintain a persistent online presence despite security vendors flagging individual URLs.
The Mechanics of Monetization
The scam does not typically steal gift card codes directly. Instead, it functions as a lead-generation engine for various “Cost Per Action” (CPA) affiliate programs. The process generally follows a specific sequence:
- The Hook: Users encounter social media ads or “sponsored” posts promising high-value gift cards for completing a short survey.
- The Survey: Victims are prompted to answer basic questions, creating a sense of engagement and investment.
- The Verification Loop: To “claim” the reward, the site forces the user through a “human verification” step. This is a deceptive interface that requires the user to complete several external tasks.
- The Conversion: These tasks often include signing up for premium mobile subscriptions, downloading specific applications, or providing sensitive personal information.
Each completed task triggers a payout to the scammers via affiliate networks. In many cases, the “verification” process is endless, redirecting the user from one offer to another without ever delivering the promised gift card.
Risks and Victim Recourse
The primary risk to users is financial loss through unauthorized mobile billing. Many of the “tasks” in the verification loop utilize Wireless Application Protocol (WAP) billing, which adds charges directly to a user’s cellular phone bill. Additionally, the personal data collected during these surveys—such as email addresses, phone numbers, and physical addresses—is often sold to other threat actors for use in phishing or identity theft.
Security analysts recommend that individuals who believe they have interacted with these sites take immediate steps to mitigate damage. This includes reviewing mobile carrier statements for any unexpected third-party subscriptions and contacting their bank if any credit card information was entered on a suspect domain. Because the campaign relies on social media for distribution, users are advised to verify “official” giveaways through the verified social media profiles or the official websites of the brands involved.