A widespread and escalating cyber fraud scheme is targeting online consumers across the globe through deceptive reward portals and fake gift card giveaways. According to research published by cybersecurity company CTM360, threat actors are leveraging the identities of major global brands and celebrity figures to drive unsuspecting users into fraudulent verification cycles and costly recurring subscriptions.
Over 1,000 Incidents Exploiting Brand Trust
CTM360 identified more than 1,000 separate incidents connected to this persistent, recurring campaign. Threat actors deliberately abuse consumer confidence in established enterprises, frequently impersonating retail and entertainment leaders such as Amazon, Walmart, PlayStation, Sephora, and SHEIN.
To capture potential victims, the campaign depends heavily on social media distribution, enticing web users with advertisements that feature supposed celebrity endorsements and promises of complimentary gift cards. Because the underlying technical infrastructure is built to be highly modular, operators can rapidly rotate domains, impersonated brands, and promotional lures without needing to redesign the core fraudulent engine.
The Psychology of the Fake Generation Trap
Analysts at CTM360 mapped out the operation as a structured fraud lifecycle designed to systematically maneuver users through progressive stages of curiosity, trust, and urgency. The trap begins when an individual clicks on a sponsored advertisement and is routed to an illegitimate reward portal featuring polished branding and authentic-looking promotional content.
Once a target selects a desired gift card denomination, the fraudulent site triggers a scripted visual animation that simulates a background card generation process. To reinforce the illusion of authenticity, the portal reveals a partially obscured redemption code, such as XXXX-XXXX-7F3A-XXXX, creating the impression that a genuine digital voucher is waiting to be claimed.
Before the full sequence is unlocked, the interface halts the user with a mandatory security check or human verification gate. In reality, this security check functions as an entry point into what CTM360 categorizes as Trap 10.
The Monetization Loop and Affiliate Tracking
Rather than providing a legitimate identity validation mechanism, the human verification gate redirects victims into an endless loop of third-party promotional tasks. These diversionary actions include mobile number submissions, app install incentives, survey completions, and PIN or one-time password verifications.
Even if an individual fulfills the requested actions, the portal continuously marks the steps as incomplete, prompting the user to finish another task. CTM360 confirmed that across all tested interaction paths, no actual gift card was ever delivered to the participant.
From a technical standpoint, the campaign distinguishes itself from conventional credential-harvesting phishing operations by deploying a high-volume conversion business model. Traffic from lure pages passes through affiliate tracking parameters, including specific values such as offer_id and aff_id, directly attributing the user’s action to the threat actor’s affiliate network profile.
Whenever a victim completes a mobile registration or confirms a subscription via an SMS one-time password, the cybercriminals receive a commission from the affiliate program. The financial structure allows threat actors to generate steady, automated revenue at scale.
Impact on Victims and Corporate Reputation
For individuals who fall victim to these deceptive portals, the consequences extend well beyond lost time. Handing over sensitive contact details frequently results in unexpected recurring charges on mobile phone statements, exposure of personal data, and a sharp increase in unsolicited spam communications.
Simultaneously, the widespread abuse of corporate identities represents a significant threat to brand integrity. By weaponizing customer loyalty and reputable trademarks to fuel affiliate marketing schemes, malicious actors continue to extract profit while undermining digital trust.
