CMP-202611-2d6csh · Other
NO FIX YET · SEE WHAT TO DO
CTM360 reports 1,000+ incidents of a recurring scam: sponsored social media ads, viral 'giveaway' posts and fabricated celebrity endorsements (MrBeast, Alix Earle) send people to fake reward portals that copy PlayStation, Sephora, SHEIN, Walmart and Amazon branding. The site fakes generating a gift card, shows a partly masked code, then demands a 'Security Check' / 'Human Verification' that loops victims through surveys, app or browser-extension installs and mobile carrier-billing subscriptions (phone number plus PIN/OTP). No gift card is ever delivered; victims lose personal data and get recurring phone charges. Targets individual consumers worldwide. Start date unknown; domains rotate and none were published.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
No product ranges from the sources yet.
Who cares campaign
endorsed by MrBeast or Alix Earle; a page with a gift card generation progress bar, countdown timer, participant counter or recent winners, a partially masked code like XXXX-XXXX-7F3A-XXXX, and a Security Check or Human Verification step before the code is revealed; links passing through affiliate tracking URLs with offer_id= and aff_id= parametersPosts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.