Fake Gift Card Scam Campaign Exploiting Trusted Brands (PlayStation, Sephora, SHEIN, Walmart, Amazon)

Key facts

Detection coverage

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5511 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Fake Gift Card Reward Lure with Affiliate Tracking Parameters (offer_id / aff_id) [SPL]

Detects web requests to non-brand hosts that carry both affiliate tracking parameters offer_id and aff_id together with reward/gift-card/human-verification lure keywords. TL-2026-5511 (CTM360, 1,000+ incidents) describes sponsored-ad and fake celebrity giveaway lures that land on cloned PlayStation, Sephora, SHEIN, Walmart, Amazon and Google Play reward portals, then push victims through a fake Security Check / Human Verification gate into an endless survey, app-install and subscription loop; the affiliate parameters tie each victim to the operator's commission account.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.002, T1204.001, T1598.003
• Data sources: proxy:zscalernss-web, proxy:pan:url, proxy:bluecoat, CommonSecurityLog, UrlClickEvents
• Severity: medium
• Confidence: medium

Splunk SPL

index=proxy sourcetype IN ("zscalernss-web","pan:url","bluecoat:proxysg:access:syslog") earliest=-24h
```TL-2026-5511 CTM360 gift card scam: affiliate params offer_id and aff_id on reward-themed URLs```
| eval url_lc=lower(coalesce(url, uri, cs_uri))
| eval dest_domain=lower(coalesce(url_domain, dest_host, dest))
| where match(url_lc, "[?&]offer_id=") AND match(url_lc, "[?&]aff_id=")
| where match(url_lc, "(gift[-_]?card|giftcard|reward|giveaway|human[-_]?verif|security[-_]?check|claim|free[-_]?(psn|robux|amazon|walmart|shein|sephora))")
```exclude the real brand domains```
| where NOT match(dest_domain, "(^|[.])(playstation|sephora|shein|walmart|amazon|google)[.](com|net)$")
| eval brand=case(match(url_lc,"playstation|psn"),"PlayStation", match(url_lc,"sephora"),"Sephora", match(url_lc,"shein"),"SHEIN", match(url_lc,"walmart"),"Walmart", match(url_lc,"amazon"),"Amazon", match(url_lc,"google[-_]?play"),"Google Play", true(),"generic_reward")
| stats count as hits min(_time) as first_seen max(_time) as last_seen dc(url_lc) as distinct_urls values(brand) as brand_lure values(url) as sample_urls by src_ip user dest_domain
| eval first_seen=strftime(first_seen,"%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen,"%Y-%m-%dT%H:%M:%SZ")
| sort - hits

Microsoft KQL

let lookback = 24h;
let legit_regex = @"(^|[.])(playstation|sephora|shein|walmart|amazon|google)[.](com|net)$";
union isfuzzy=true
  (CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where isnotempty(RequestURL)
    | project TimeGenerated, User=SourceUserName, SrcIP=SourceIP, Url=RequestURL),
  (UrlClickEvents
    | where Timestamp > ago(lookback)
    | project TimeGenerated=Timestamp, User=AccountUpn, SrcIP=IPAddress, Url)
| extend UrlLc = tolower(Url)
| where UrlLc matches regex @"[?&]offer_id=" and UrlLc matches regex @"[?&]aff_id="
| where UrlLc matches regex @"(gift[-_]?card|giftcard|reward|giveaway|human[-_]?verif|security[-_]?check|claim|free[-_]?(psn|robux|amazon|walmart|shein|sephora))"
| extend Host = tolower(tostring(parse_url(Url).Host))
| where not(Host matches regex legit_regex)
| extend BrandLure = case(UrlLc has_any ("playstation","psn"), "PlayStation", UrlLc has "sephora", "Sephora", UrlLc has "shein", "SHEIN", UrlLc has "walmart", "Walmart", UrlLc has "amazon", "Amazon", UrlLc matches regex @"google[-_]?play", "Google Play", "generic_reward")
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), BrandLures=make_set(BrandLure), SampleUrls=make_set(Url, 5) by User, SrcIP, Host
| order by Hits desc

Sigma

title: Fake Gift Card Reward Lure with Affiliate Tracking Parameters
id: 6f1c2a10-5b7e-4c3a-9a11-3d0e5a7b1001
status: experimental
description: Detects proxy requests to non-brand hosts that carry the offer_id and aff_id affiliate parameters together with reward or gift card lure keywords, as reported in TL-2026-5511 (CTM360 fake gift card scam campaign).
references:
    - https://www.bleepingcomputer.com/news/security/ctm360-exposes-fake-gift-card-scams-exploiting-trusted-brands/
    - https://www.ctm360.com/reports/gift-card-scams
author: Threadlinqs Team
date: 2026/11/07
tags:
    - attack.initial-access
    - attack.execution
    - attack.reconnaissance
    - attack.t1566.002
    - attack.t1204.001
    - attack.t1598.003
logsource:
    category: proxy
detection:
    selection_affiliate:
        c-uri|contains|all:
            - 'offer_id='
            - 'aff_id='
    selection_lure:
        c-uri|contains:
            - 'giftcard'
            - 'gift-card'
            - 'gift_card'
            - 'reward'
            - 'giveaway'
            - 'human-verif'
            - 'humanverif'
            - 'security-check'
            - 'securitycheck'
            - 'claim'
    filter_legit_brand:
        cs-host|endswith:
            - '.playstation.com'
            - '.sephora.com'
            - '.shein.com'
            - '.walmart.com'
            - '.amazon.com'
            - 'play.google.com'
    condition: selection_affiliate and selection_lure and not filter_legit_brand
falsepositives:
    - Legitimate affiliate marketing or partner redirect pages
    - Authorised phishing simulations using gift card themes
level: medium

Known false positives:

• Legitimate affiliate-marketing or retailer partner redirect pages that use offer_id/aff_id with promotional wording
• Marketing or brand-protection teams testing their own affiliate links
• Security awareness phishing simulations that reuse gift card themes

Tuning notes: Add known affiliate-network and partner domains to the exclusion list, and tighten the lure keyword list if promotional portals are common. Pivot on aff_id values seen across multiple victims to find the operator account. Feed confirmed scam domains from CTM360 or brand-protection feeds into a blocklist and tighten the rule.

• 🔒 Fake Gift Card Reward Lure with Affiliate Tracking Parameters (offer_id / aff_id) [KQL] · unlock with TL Creds
• 🔒 Fake Gift Card Affiliate Flow - Mobile Number / PIN-OTP Subscription or App Install [KQL] · unlock with TL Creds
• 🔒 Brand-Impersonating Gift Card Reward Domain and Community-Related Malvertising Infrastructure [KQL] · unlock with TL Creds
• 🔒 Fake Gift Card Reward Lure with Affiliate Tracking Parameters (offer_id / aff_id) [Sigma] · unlock with TL Creds
• 🔒 Fake Gift Card Affiliate Flow - Mobile Number / PIN-OTP Subscription or App Install [Sigma] · unlock with TL Creds
• 🔒 Brand-Impersonating Gift Card Reward Domain and Community-Related Malvertising Infrastructure [Sigma] · unlock with TL Creds
• 🔒 Fake Gift Card Affiliate Flow - Mobile Number / PIN-OTP Subscription or App Install [SPL] · unlock with TL Creds
• 🔒 Brand-Impersonating Gift Card Reward Domain and Community-Related Malvertising Infrastructure [SPL] · unlock with TL Creds

Indicators of compromise

As of 2026-11-07, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5511.

Technical analysis

CTM360 reports a widespread, affiliate-monetized gift card scam campaign with more than 1,000 linked incidents. The lures impersonate well-known consumer brands. BleepingComputer's sponsored write-up names PlayStation, Sephora, SHEIN, Walmart and Amazon. CTM360's own report page lists PlayStation, Google Play, Sephora, SHEIN and Walmart. Both brand lists are recorded here because the sources differ.

Victims arrive through sponsored social media ads and viral giveaway posts, some using fabricated endorsements from celebrities and influencers (MrBeast and Alix Earle are named). The ads redirect to fraudulent reward portals that show cloned brand logos, fake participant counters, countdown timers and fabricated testimonials. After the victim selects a gift card value, the site plays an animated 'generation' sequence that displays partially masked codes such as XXXX-XXXX-7F3A-XXXX to make the reward look real.

The pivot is a 'Security Check' or 'Human Verification' gate. It is not a real verification step. It sends the victim into an endless loop of tasks: surveys, app installations and paid mobile subscriptions. CTM360 states that no reward was ever delivered even after the tasks were completed. Affiliate tracking URLs pass parameters such as offer_id and aff_id, which tie each victim registration to the operator's affiliate-network account. Commissions are reportedly triggered when the victim submits a mobile number and verifies a subscription PIN/OTP. CTM360 describes the operation as an affiliate-based monetization model, and it says the infrastructure is modular, so brands and domains can be swapped.

Consequences for victims are exposure of personal information, unexpected mobile billing charges, spam, and possible installation of malicious applications. The sources contain no CVE, no technical vulnerability, no actor attribution and no published domains, IPs or hashes. The BleepingComputer article is labeled sponsored content by CTM360. Severity is MEDIUM, an analyst judgment for consumer-fraud scope. This is vendor-reported, single-source telemetry.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading; T1684.001 Impersonation

Execution

T1204.001 Malicious Link; T1204.002 Malicious File

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.008 Malvertising

Reconnaissance

T1598.003 Spearphishing Link

Impact

T1657 Financial Theft

Remediation

Immediate actions

• Block or sinkhole confirmed scam portal domains once identified by brand-protection or threat-intel feeds
• Report fraudulent social media ads to the platform and the impersonated brand's abuse or brand-protection team
• Warn users that legitimate brands do not require surveys, app installs or mobile subscriptions to claim a gift card
• Advise victims who entered a mobile number or OTP to contact their carrier to dispute and cancel premium subscriptions

Workarounds

• Ask carriers to enable premium SMS and carrier-billing blocks on managed or consumer lines
• Use browser or DNS filtering categories for scam, phishing and newly registered domains

Longer-term hardening

• Run user awareness training on fake giveaway and celebrity-endorsement scams
• Monitor for typosquat and brand-impersonating lookalike domains and ads (brand protection / digital risk protection)
• Hunt web proxy and DNS logs for affiliate tracking parameters such as offer_id and aff_id on reward-themed pages
• Enforce mobile device management controls restricting sideloaded or unvetted app installs

Affected and fixed versions

• Social media advertising platforms — Sponsored ads and viral giveaway posts (abused as delivery channel)
• Impersonated brands — PlayStation, Sephora, SHEIN, Walmart, Amazon, Google Play (brand impersonation, not vulnerable software)
• Mobile carriers — Carrier billing / premium subscription services (abused for monetization)

Timeline

• 2026-11-07 Threadlinqs hunt flags the campaign as ACTIVE, MEDIUM severity (analyst judgment); no domains, IPs or hashes published in the source.
• 2026-11-07 Affiliate tracking URLs (offer_id, aff_id) tie registrations to the operator's affiliate account; commissions reportedly trigger on mobile number submission and subscription PIN/OTP verification.
• 2026-11-07 Fake 'Security Check' / 'Human Verification' gate routes victims into an endless loop of surveys, app installs and paid mobile subscriptions; no reward is delivered.
• 2026-11-07 Victims land on fraudulent reward portals with cloned branding, participant counters, countdown timers, testimonials and an animated gift card generation with masked codes.
• 2026-11-07 Campaign delivers lures via sponsored social media ads and viral giveaway posts, some with fabricated celebrity endorsements (MrBeast, Alix Earle).
• 2026-11-07 CTM360 publicly reports more than 1,000 incidents of a fake gift card scam campaign impersonating trusted brands; coverage published on BleepingComputer as sponsored content.

Sources cited

• FTC Consumer Advice - gift card scams consumer.ftc.gov · Advisory
• CTM360 - Gift Card Scams report ctm360.com · Research · 2026-11-07
• Fortra - Gift card scams fortra.com · Blog
• CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands (sponsored content by CTM360) BleepingComputer · News · 2026-11-07
• Related campaign (different, not linked by sources): Google Play/Amazon gift card scam using hundreds of auto-generated domains (Palo Alto Networks research) cybersecuritynews.com · News · 2025-02-06

More in phishing

• Utility Impostor Scams: Lookalike Domains, Scam Ads and Phishing-as-a-Service (Darcula V3) Targeting Utility Customers
• 110-Domain Fake Copyright-Strike (DMCA/YouTube) Phishing Estate Using Browser-in-the-Browser Google Credential Harvesting
• SkyW4lker-Associated Microsoft OAuth Phishing via Adobe-Hosted PDF Lure (slybee.com)
• Holiday Phishing Scams 2026: Black Friday-Themed Phishing, Quishing, Callback Fraud and BEC Targeting Employees
• BluePhishing: Initial Access via Third-Party Agent Blueprint Consent (Microsoft Entra Agent ID)

Previous and next in phishing

• Device Code Phishing: Turning a Convenience Feature Into an MFA Bypass (Microsoft 365/Entra ID) Previous report
• Large-Scale Tech Support Scam Email Campaign Targeting Users and Organizations in Japan (13M+ Emails) Next report