CTM360 Exposes Fake Gift Card Scams Targeting Consumers

Security analysts at CTM360 have identified an ongoing affiliate monetisation campaign comprising more than 1,000 incidents that impersonate trusted consumer brands with fraudulent gift card giveaways. The scheme exploits brand trust to trick victims into completing deceptive verification loops, installing unwanted software, and enrolling in recurring mobile subscriptions. Threat actors systematically lure users through sponsored social media advertisements and fabricated celebrity endorsements. In Malaysia, individuals targeted by similar online subscription and giveaway ruses can lodge reports with the National Scam Response Centre at 997 or Cyber999.

Key Facts

How Does the Fake Gift Card Generation Scheme Work?

The campaign lures users via sponsored advertisements and fabricated endorsements onto fraudulent reward portals displaying cloned logos and countdown timers. After selecting a gift card value, a scripted visual animation displays a partially masked voucher code, prompting the victim to complete a deceptive security verification step to reveal the final characters.

Analysts observed that the underlying infrastructure is modular, enabling threat actors to alternate domains, celebrity lures, and impersonated brands without rebuilding the core engine. Impersonated organisations include Amazon, PlayStation, Sephora, SHEIN, and Walmart, promoted using false endorsements from figures such as MrBeast and Alix Earle. Rather than conducting an authentic security check, the portal routes users into a sequence designated by CTM360 as Trap 10.

In all verification and generation flows tested by CTM360, no actual gift card was ever delivered to the user.

How Do Operators Monetise the Verification Loop?

Unlike conventional phishing operations targeting login credentials, this scheme generates revenue through affiliate conversion networks. Victims attempting human verification are routed through affiliate tracking parameters to complete surveys, install unwanted software applications or browser extensions, and enter mobile phone numbers that trigger recurring carrier-billing subscription charges without their genuine consent.

The technical delivery relies on tracking parameters such as offer_id and aff_id embedded in tracking links. When a user submits their mobile number and completes a one-time password or PIN verification, the transaction registers as a successful conversion on the threat actor's affiliate network account. The fraudulent portal repeatedly marks verification steps as incomplete to push users into successive external offers, leading to recurring mobile fees, spam, and personal data exposure.

Threat actors receive affiliate commission payouts when victims complete mobile number submissions and one-time password verifications.

What Should You Do?

• Recognise that no software patch is available, as this activity relies on brand impersonation rather than technical system vulnerabilities.
• Avoid clicking on sponsored social media advertisements, viral posts, or influencer endorsements promoting free gift card generators.
• Never submit mobile telephone numbers, PIN codes, or one-time verification passwords to unverified third-party reward websites.
• Refrain from downloading applications, surveys, or browser extensions presented during online verification prompts.
• Regularly inspect mobile phone billing statements for unexpected charges linked to third-party carrier-billing subscriptions.
• Report suspected deceptive subscription ruses in Malaysia to the National Scam Response Centre at 997 or through Cyber999.

Common Questions

Are real gift card codes ever generated by these portals?

No legitimate gift cards are ever provided. The simulated progress animations and partially masked voucher codes displayed on the portals are deceptive front-end scripts designed solely to persuade users to undertake monetised third-party verification tasks, surveys, and software installations.

What personal data or financial risks do victims face?

Victims face unauthorised recurring mobile carrier charges, exposure of personal contact information, an influx of spam, and the potential installation of unwanted applications or browser extensions. Unlike standard phishing, the threat operators focus on earning commissions by converting victims into paid mobile subscribers.

Which brands and public figures have threat actors impersonated?

CTM360 identified campaigns impersonating major consumer platforms and retailers, specifically Amazon, PlayStation, Sephora, SHEIN, and Walmart. The fraudulent advertisements and giveaway posts also featured fabricated endorsements from high-profile celebrities and online personalities, including MrBeast and Alix Earle, across social media platforms.

Sources and Methodology

This news dispatch is based solely on reporting published by BleepingComputer on November 7, 2026, which details research conducted and sponsored by CTM360. ROCKSTARmedia Infosec has not reviewed external technical documents or third-party advisories beyond the provided source material.