VULNpocalypse
LowEcosystem changeMonitoring

CTM360 claims fake gift card scams abuse trusted brands

CTM360 claims in a sponsored BleepingComputer post that fake gift card sites abuse brands; never enter a phone number or OTP on them.

Published
Exploitation
No vulnerability involved. CTM360 claims it observed more than 1,000 incidents of the scam campaign, not independently verified.

What happened

According to CTM360, a security company, fake gift card giveaways and fraudulent reward portals are surging globally. The claim appears in an article on BleepingComputer that is labelled “Sponsored and written by CTM360”. It is a vendor’s own report, not independent reporting, and BleepingComputer is the only outlet in our sources.

CTM360 says its analysts identified more than 1,000 incidents linked to one recurring campaign, based on activity it observed. It says the lures impersonate brands such as PlayStation, Sephora, SHEIN, Walmart and Amazon. It also says they use sponsored social media ads, viral “giveaway” posts and fabricated celebrity endorsements, naming MrBeast and Alix Earle.

CTM360 describes this flow:

  • The victim clicks an ad and lands on a portal with cloned brand logos, fake participant counters, countdown timers and invented testimonials.
  • After the victim picks a gift card value, the site plays a scripted progress animation and shows a partially masked code.
  • A “Security Check” or “Human Verification” gate follows. CTM360 calls this “Trap 10”.
  • The gate sends the victim to surveys, quizzes, promotional offers, unwanted apps or browser extensions, and paid mobile subscriptions billed through carriers.
  • CTM360 says that in all flows it tested, no reward was ever delivered.

CTM360 also says the lure pages redirect through affiliate tracking URLs with parameters such as offer_id and aff_id. It says these tie a victim’s registration to the operator’s affiliate account, and that the operator earns a commission when a victim submits a mobile number and completes PIN/OTP verification for a subscription. It describes the campaign as a volume-and-conversion model rather than credential theft, and says the infrastructure is modular, so the brand, celebrity lure and domain can be swapped.

Not confirmed: the source names no operator or actor, gives no victim count or financial losses, and gives no start date for the campaign. The 1,000+ figure is CTM360’s own and has not been independently verified. No CVE or software vulnerability is involved.

Am I affected?

You are potentially exposed if you click social media ads or posts offering free gift cards from well-known brands. According to CTM360, consequences for victims include personal information exposure, unexpected mobile billing charges and spam.

CTM360 says brand owners are affected through abuse of their reputation. Whether any named brand has responded or confirmed anything is not confirmed in the source.

What to do now

These steps follow from the behaviour CTM360 describes. The source itself offers little specific guidance and promotes CTM360’s Digital Risk Protection product.

  1. Treat unsolicited gift card giveaways, especially those citing celebrity endorsements, as suspect. CTM360 says no reward was delivered in any flow it tested.
  2. Do not enter a mobile number or a PIN/OTP on a reward portal. CTM360 says this step is what enrolls victims in paid carrier-billed subscriptions and earns the operator a commission.
  3. Do not install apps or browser extensions that a “verification” step asks for.
  4. If you already submitted a number or code, check your mobile bill for unexpected recurring charges. Ask your carrier about them.
  5. Brand owners can review CTM360’s full report, linked from the BleepingComputer article, and weigh its claims. They remain unverified by an independent party.

Sources