Security firm CTM360 has published findings on a large-scale fake gift card scheme that uses brand impersonation and celebrity endorsements to funnel users into revenue-generating traps. Based on activity the firm observed, analysts linked more than 1,000 incidents to the recurring campaign. Despite the polished presentation, no actual gift cards are delivered to victims.

Lure and Distribution

The campaigns frequently impersonate well-known retailers and consumer platforms, including PlayStation, Sephora, SHEIN, Walmart, and Amazon. Distribution relies heavily on social media through sponsored ads, viral “giveaway” posts, and fabricated endorsements attributed to high-profile celebrities and influencers. According to CTM360, the underlying infrastructure is modular, allowing operators to swap the impersonated brand, celebrity lure, or domain without rebuilding the core scam engine.

How the Scam Progresses

Victims who click an ad land on a fraudulent reward portal displaying cloned brand logos, fake participant counts, countdown timers, and testimonials from supposed winners. After a user selects a gift card value, a scripted animation simulates card generation and displays a partially masked code to lend credibility. Before the full code is shown, the victim is directed to a “Security Check” or “Human Verification” gate.

Rather than performing a genuine security check, this step routes users through a loop of surveys, quizzes, promotional offers, third-party app or browser extension installs, and paid mobile subscriptions billed through carrier mechanisms. Completing a task does not yield a reward. The site instead reports the step as incomplete and presents another offer. CTM360 stated that no reward was delivered in any flow it tested.

Affiliate Monetization Model

Unlike traditional phishing that targets credentials, this campaign operates on a volume-and-conversion model. CTM360 observed lure pages passing affiliate tracking parameters, such as offer and affiliate identifiers, that tie a victim’s registration to the operator’s affiliate network account. When a victim submits a mobile number and completes PIN or one-time-password verification for a subscription, the operator earns a commission.

Impact

Victims may face exposure of personal information, unexpected mobile billing charges, and increased spam. For organizations, the abuse of brand names damages reputation and can confuse customers. The findings illustrate how attackers are using brand trust at scale to drive affiliate conversions. Security teams concerned with brand abuse may wish to review CTM360’s full report for indicators and mitigation guidance.