{"id":"CMP-202611-2d6csh","kind":"campaign","aliases":[],"related":[],"title":"Fake free gift card giveaways (PlayStation, Sephora, SHEIN, Walmart, Amazon) with fake MrBeast endorsements trap victims in a 'human verification' loop that signs them up for paid phone subscriptions (CTM360)","description":null,"summary":"CTM360 reports 1,000+ incidents of a recurring scam: sponsored social media ads, viral 'giveaway' posts and fabricated celebrity endorsements (MrBeast, Alix Earle) send people to fake reward portals that copy PlayStation, Sephora, SHEIN, Walmart and Amazon branding. The site fakes generating a gift card, shows a partly masked code, then demands a 'Security Check' / 'Human Verification' that loops victims through surveys, app or browser-extension installs and mobile carrier-billing subscriptions (phone number plus PIN/OTP). No gift card is ever delivered; victims lose personal data and get recurring phone charges. Targets individual consumers worldwide. Start date unknown; domains rotate and none were published.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"A message, ad or post offering a free gift card from PlayStation, Sephora, SHEIN, Walmart or Amazon, often 'endorsed' by MrBeast or Alix Earle; a page with a gift card generation progress bar, countdown timer, participant counter or 'recent winners', a partially masked code like XXXX-XXXX-7F3A-XXXX, and a 'Security Check' or 'Human Verification' step before the code is revealed; links passing through affiliate tracking URLs with offer_id= and aff_id= parameters. No sender or link domains were published (they rotate).","fix":"Treat it as a scam: do not enter your phone number, PIN or one-time code, and do not install the apps or extensions it asks for. If you already did, check your mobile bill for new premium/carrier-billing subscriptions and ask your carrier to cancel them and block premium SMS billing, uninstall any apps or browser extensions you added, and expect more spam. Report the ad to the social platform.","status":"open","published_at":null,"first_seen_at":"2026-11-07T14:52:01+00:00","triaged_at":"2026-11-07T14:52:01+00:00","updated_at":"2026-11-07T14:53:13+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-2':33A '-202611':32A '000':42B '1':41B 'ad':51B 'alix':60B 'amazon':10A,75B 'app':101B 'bill':111B 'brand':76B 'browser':104B 'browser-extens':103B 'campaign':35B 'card':4A,83B,119B 'carrier':110B 'carrier-bil':109B 'celebr':57B 'charg':131B 'check':93B 'cmp':31A 'code':88B 'consum':134B 'copi':69B 'ctm360':30A,39B 'd6csh':34A 'data':126B 'date':137B 'deliv':122B 'demand':90B 'domain':139B 'earl':61B 'earli':37B 'early-warn':36B 'endors':14A,58B 'ever':121B 'extens':105B 'fabric':56B 'fake':1A,12A,65B,79B 'free':2A 'generat':80B 'get':128B 'gift':3A,82B,118B 'giveaway':5A,53B 'human':19A,94B 'incid':43B 'individu':133B 'instal':106B 'loop':21A,97B 'lose':124B 'mask':87B 'media':50B 'mobil':108B 'mrbeast':13A,59B 'none':142B 'number':114B 'paid':27A 'part':86B 'peopl':63B 'person':125B 'phone':28A,113B,130B 'pin/otp':116B 'playstat':6A,70B 'plus':115B 'portal':67B 'post':54B 'publish':144B 'recur':46B,129B 'report':40B 'reward':66B 'rotat':140B 'scam':47B 'secur':92B 'send':62B 'sephora':7A,71B 'shein':8A,72B 'show':84B 'sign':23A 'site':78B 'social':49B 'sponsor':48B 'start':136B 'subscript':29A,112B 'survey':100B 'target':132B 'trap':15A 'unknown':138B 'verif':20A,95B 'victim':16A,98B,123B 'viral':52B 'walmart':9A,73B 'warn':38B 'worldwid':135B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":[],"ptokens":[],"labels":["campaign","earlywarning","medium","other"],"campaign_type":"fraud","search_a":"'-2':33A '-202611':32A 'amazon':10A 'card':4A 'cmp':31A 'ctm360':30A 'd6csh':34A 'endors':14A 'fake':1A,12A 'free':2A 'gift':3A 'giveaway':5A 'human':19A 'loop':21A 'mrbeast':13A 'paid':27A 'phone':28A 'playstat':6A 'sephora':7A 'shein':8A 'sign':23A 'subscript':29A 'trap':15A 'verif':20A 'victim':16A 'walmart':9A","search_b":"'000':42B '1':41B 'ad':51B 'alix':60B 'amazon':75B 'app':101B 'bill':111B 'brand':76B 'browser':104B 'browser-extens':103B 'campaign':35B 'card':83B,119B 'carrier':110B 'carrier-bil':109B 'celebr':57B 'charg':131B 'check':93B 'code':88B 'consum':134B 'copi':69B 'ctm360':39B 'data':126B 'date':137B 'deliv':122B 'demand':90B 'domain':139B 'earl':61B 'earli':37B 'early-warn':36B 'endors':58B 'ever':121B 'extens':105B 'fabric':56B 'fake':65B,79B 'generat':80B 'get':128B 'gift':82B,118B 'giveaway':53B 'human':94B 'incid':43B 'individu':133B 'instal':106B 'loop':97B 'lose':124B 'mask':87B 'media':50B 'mobil':108B 'mrbeast':59B 'none':142B 'number':114B 'part':86B 'peopl':63B 'person':125B 'phone':113B,130B 'pin/otp':116B 'playstat':70B 'plus':115B 'portal':67B 'post':54B 'publish':144B 'recur':46B,129B 'report':40B 'reward':66B 'rotat':140B 'scam':47B 'secur':92B 'send':62B 'sephora':71B 'shein':72B 'show':84B 'site':78B 'social':49B 'sponsor':48B 'start':136B 'subscript':112B 'survey':100B 'target':132B 'unknown':138B 'verif':95B 'victim':98B,123B 'viral':52B 'walmart':73B 'warn':38B 'worldwid':135B","search_c":"","first_public_at":"2026-11-07T14:10:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-2d6csh","url":"https://www.ctm360.com/reports/gift-card-scams","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-07T14:52:01+00:00","fetched_at":"2026-11-07T14:52:01+00:00","note":null,"cites":["https://www.ctm360.com/reports/gift-card-scams"]}],"documents":[{"id":96039,"url":"https://x.com/BleepinComputer/status/2119074896370372862","title":"@BleepinComputer: 🎁 Claim a free gift card, complete a quick security check, and collect your rewa","kind":"post","source":"x","publisher":null,"text":"🎁 Claim a free gift card, complete a quick security check, and collect your reward. Except the gift card doesn't exist.\n\n🔍 @teamCTM360 exposes how scammers use fake giveaways to push paid subscriptions.\n\n➡️ https://t.co/UjTdVt27wo\n#cybersecurity #sponsored https://t.co/WkzDfEzpjS\n\nlikes 3 reposts 1","published_at":"2026-11-07T14:30:00+00:00","relation":"describes","confidence":null,"note":null},{"id":96189,"url":"https://www.ctm360.com/reports/gift-card-scams","title":"CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands","kind":"blog","source":"analyst","publisher":null,"text":"CTM360: 1,000+ incidents of fake gift card giveaway / reward portals impersonating PlayStation, Sephora, SHEIN, Walmart, Amazon, pushed via sponsored social media ads, viral giveaway posts and fake celebrity endorsements (MrBeast, Alix Earle). Victims pick a gift card value, see a fake generation progress bar and a partially masked code (e.g. XXXX-XXXX-7F3A-XXXX), then a 'Security Check' / 'Human Verification' gate that loops them through surveys, app/browser-extension installs and paid mobile carrier-billing subscriptions (phone number + PIN/OTP). Redirects via affiliate tracking URLs with offer_id and aff_id parameters. No gift card is ever delivered. Domains rotate; none listed.","published_at":"2026-11-07T14:10:19+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}