# Fake Gift Card Scam Campaign Exploiting Trusted Brands (PlayStation, Sephora, SHEIN, Walmart, Amazon)

> CTM360 identified more than 1,000 incidents of a fake gift card scam campaign impersonating trusted brands through social media ads and fabricated celebrity endorsements. Victims are pushed through fake human-verification gates into affiliate-tracked surveys, app installs and carrier-billed mobile subscriptions, and no reward is ever delivered.

- **Published:** 2026-11-07T14:19:00Z
- **Last reviewed:** 2026-11-07T14:19:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5511
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5511.png
- **ID:** TL-2026-5511
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 9

## Description

CTM360 reports a widespread, affiliate-monetized gift card scam campaign with more than 1,000 linked incidents. The lures impersonate well-known consumer brands. BleepingComputer's sponsored write-up names PlayStation, Sephora, SHEIN, Walmart and Amazon. CTM360's own report page lists PlayStation, Google Play, Sephora, SHEIN and Walmart. Both brand lists are recorded here because the sources differ.

Victims arrive through sponsored social media ads and viral giveaway posts, some using fabricated endorsements from celebrities and influencers (MrBeast and Alix Earle are named). The ads redirect to fraudulent reward portals that show cloned brand logos, fake participant counters, countdown timers and fabricated testimonials. After the victim selects a gift card value, the site plays an animated 'generation' sequence that displays partially masked codes such as XXXX-XXXX-7F3A-XXXX to make the reward look real.

The pivot is a 'Security Check' or 'Human Verification' gate. It is not a real verification step. It sends the victim into an endless loop of tasks: surveys, app installations and paid mobile subscriptions. CTM360 states that no reward was ever delivered even after the tasks were completed. Affiliate tracking URLs pass parameters such as offer_id and aff_id, which tie each victim registration to the operator's affiliate-network account. Commissions are reportedly triggered when the victim submits a mobile number and verifies a subscription PIN/OTP. CTM360 describes the operation as an affiliate-based monetization model, and it says the infrastructure is modular, so brands and domains can be swapped.

Consequences for victims are exposure of personal information, unexpected mobile billing charges, spam, and possible installation of malicious applications. The sources contain no CVE, no technical vulnerability, no actor attribution and no published domains, IPs or hashes. The BleepingComputer article is labeled sponsored content by CTM360. Severity is MEDIUM, an analyst judgment for consumer-fraud scope. This is vendor-reported, single-source telemetry.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1566.002 Spearphishing Link
- T1036 Masquerading
- T1684.001 Impersonation
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1598.003 Spearphishing Link
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Fake Gift Card Reward Lure with Affiliate Tracking Parameters (offer_id / aff_id) [SPL]** (`TL-2026-5511-SPL-001`)

Detects web requests to non-brand hosts that carry both affiliate tracking parameters offer_id and aff_id together with reward/gift-card/human-verification lure keywords. TL-2026-5511 (CTM360, 1,000+ incidents) describes sponsored-ad and fake celebrity giveaway lures that land on cloned PlayStation, Sephora, SHEIN, Walmart, Amazon and Google Play reward portals, then push victims through a fake Security Check / Human Verification gate into an endless survey, app-install and subscription loop; the affiliate parameters tie each victim to the operator's commission account.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.002, T1204.001, T1598.003
- **Data sources:** proxy:zscalernss-web, proxy:pan:url, proxy:bluecoat, CommonSecurityLog, UrlClickEvents
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

````spl
index=proxy sourcetype IN ("zscalernss-web","pan:url","bluecoat:proxysg:access:syslog") earliest=-24h
```TL-2026-5511 CTM360 gift card scam: affiliate params offer_id and aff_id on reward-themed URLs```
| eval url_lc=lower(coalesce(url, uri, cs_uri))
| eval dest_domain=lower(coalesce(url_domain, dest_host, dest))
| where match(url_lc, "[?&]offer_id=") AND match(url_lc, "[?&]aff_id=")
| where match(url_lc, "(gift[-_]?card|giftcard|reward|giveaway|human[-_]?verif|security[-_]?check|claim|free[-_]?(psn|robux|amazon|walmart|shein|sephora))")
```exclude the real brand domains```
| where NOT match(dest_domain, "(^|[.])(playstation|sephora|shein|walmart|amazon|google)[.](com|net)$")
| eval brand=case(match(url_lc,"playstation|psn"),"PlayStation", match(url_lc,"sephora"),"Sephora", match(url_lc,"shein"),"SHEIN", match(url_lc,"walmart"),"Walmart", match(url_lc,"amazon"),"Amazon", match(url_lc,"google[-_]?play"),"Google Play", true(),"generic_reward")
| stats count as hits min(_time) as first_seen max(_time) as last_seen dc(url_lc) as distinct_urls values(brand) as brand_lure values(url) as sample_urls by src_ip user dest_domain
| eval first_seen=strftime(first_seen,"%Y-%m-%dT%H:%M:%SZ"), last_seen=strftime(last_seen,"%Y-%m-%dT%H:%M:%SZ")
| sort - hits
````

### Microsoft KQL

```kql
let lookback = 24h;
let legit_regex = @"(^|[.])(playstation|sephora|shein|walmart|amazon|google)[.](com|net)$";
union isfuzzy=true
  (CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where isnotempty(RequestURL)
    | project TimeGenerated, User=SourceUserName, SrcIP=SourceIP, Url=RequestURL),
  (UrlClickEvents
    | where Timestamp > ago(lookback)
    | project TimeGenerated=Timestamp, User=AccountUpn, SrcIP=IPAddress, Url)
| extend UrlLc = tolower(Url)
| where UrlLc matches regex @"[?&]offer_id=" and UrlLc matches regex @"[?&]aff_id="
| where UrlLc matches regex @"(gift[-_]?card|giftcard|reward|giveaway|human[-_]?verif|security[-_]?check|claim|free[-_]?(psn|robux|amazon|walmart|shein|sephora))"
| extend Host = tolower(tostring(parse_url(Url).Host))
| where not(Host matches regex legit_regex)
| extend BrandLure = case(UrlLc has_any ("playstation","psn"), "PlayStation", UrlLc has "sephora", "Sephora", UrlLc has "shein", "SHEIN", UrlLc has "walmart", "Walmart", UrlLc has "amazon", "Amazon", UrlLc matches regex @"google[-_]?play", "Google Play", "generic_reward")
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), BrandLures=make_set(BrandLure), SampleUrls=make_set(Url, 5) by User, SrcIP, Host
| order by Hits desc
```

### Sigma

```yaml
title: Fake Gift Card Reward Lure with Affiliate Tracking Parameters
id: 6f1c2a10-5b7e-4c3a-9a11-3d0e5a7b1001
status: experimental
description: Detects proxy requests to non-brand hosts that carry the offer_id and aff_id affiliate parameters together with reward or gift card lure keywords, as reported in TL-2026-5511 (CTM360 fake gift card scam campaign).
references:
    - https://www.bleepingcomputer.com/news/security/ctm360-exposes-fake-gift-card-scams-exploiting-trusted-brands/
    - https://www.ctm360.com/reports/gift-card-scams
author: Threadlinqs Team
date: 2026/11/07
tags:
    - attack.initial-access
    - attack.execution
    - attack.reconnaissance
    - attack.t1566.002
    - attack.t1204.001
    - attack.t1598.003
logsource:
    category: proxy
detection:
    selection_affiliate:
        c-uri|contains|all:
            - 'offer_id='
            - 'aff_id='
    selection_lure:
        c-uri|contains:
            - 'giftcard'
            - 'gift-card'
            - 'gift_card'
            - 'reward'
            - 'giveaway'
            - 'human-verif'
            - 'humanverif'
            - 'security-check'
            - 'securitycheck'
            - 'claim'
    filter_legit_brand:
        cs-host|endswith:
            - '.playstation.com'
            - '.sephora.com'
            - '.shein.com'
            - '.walmart.com'
            - '.amazon.com'
            - 'play.google.com'
    condition: selection_affiliate and selection_lure and not filter_legit_brand
falsepositives:
    - Legitimate affiliate marketing or partner redirect pages
    - Authorised phishing simulations using gift card themes
level: medium

```

**Known false positives:**

- Legitimate affiliate-marketing or retailer partner redirect pages that use offer_id/aff_id with promotional wording
- Marketing or brand-protection teams testing their own affiliate links
- Security awareness phishing simulations that reuse gift card themes

**Tuning notes:** Add known affiliate-network and partner domains to the exclusion list, and tighten the lure keyword list if promotional portals are common. Pivot on aff_id values seen across multiple victims to find the operator account. Feed confirmed scam domains from CTM360 or brand-protection feeds into a blocklist and tighten the rule.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Fake Gift Card Reward Lure with Affiliate Tracking Parameters (offer_id / aff_id) [KQL] (locked: unlock with TL Creds)
- Fake Gift Card Affiliate Flow - Mobile Number / PIN-OTP Subscription or App Install [KQL] (locked: unlock with TL Creds)
- Brand-Impersonating Gift Card Reward Domain and Community-Related Malvertising Infrastructure [KQL] (locked: unlock with TL Creds)
- Fake Gift Card Reward Lure with Affiliate Tracking Parameters (offer_id / aff_id) [Sigma] (locked: unlock with TL Creds)
- Fake Gift Card Affiliate Flow - Mobile Number / PIN-OTP Subscription or App Install [Sigma] (locked: unlock with TL Creds)
- Brand-Impersonating Gift Card Reward Domain and Community-Related Malvertising Infrastructure [Sigma] (locked: unlock with TL Creds)
- Fake Gift Card Affiliate Flow - Mobile Number / PIN-OTP Subscription or App Install [SPL] (locked: unlock with TL Creds)
- Brand-Impersonating Gift Card Reward Domain and Community-Related Malvertising Infrastructure [SPL] (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands (sponsored content by CTM360)](https://www.bleepingcomputer.com/news/security/ctm360-exposes-fake-gift-card-scams-exploiting-trusted-brands/)
- [CTM360 - Gift Card Scams report](https://www.ctm360.com/reports/gift-card-scams)
- [FTC Consumer Advice - gift card scams](https://consumer.ftc.gov/node/328341)
- [Fortra - Gift card scams](https://www.fortra.com/blog/gift-card-scams)
- [Related campaign (different, not linked by sources): Google Play/Amazon gift card scam using hundreds of auto-generated domains (Palo Alto Networks research)](https://cybersecuritynews.com/google-play-amazon-gift-card-using-100s-of-malicious-domains-to-steal-data/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5511