[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fODZVPsBGReqwTv3EvhOo8dZemn703iuDKxoRxy17T_Y":3},{"article":4,"iocs":39,"watch_terms":44,"solutions":45,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"2d0c35a5-8493-44f0-81e7-833ee4406d43","CTM360 Exposes Fake Gift Card Scams Exploiting Trusted Brands","ctm360-exposes-fake-gift-card-scams-exploiting-trusted-brands-5a7630","Scammers are impersonating major brands and celebrities to lure consumers into fake gift card giveaways that collect personal information and trigger unwanted subscriptions. CTM360 reveals how these campaigns use deceptive verification steps and affiliate networks to generate revenue without delivering the promised rewards. [...]","CTM360 has exposed a global scam campaign using fake gift card giveaways that impersonate major brands and celebrities. These schemes lure victims with promises of rewards but instead lead them through deceptive verification steps, resulting in personal information theft, app installs, and unwanted subscriptions. The campaigns leverage affiliate networks for monetization, with over 1,000 incidents reported.","Scammers impersonate brands and celebrities for fake gift card giveaways to steal data and trigger subscriptions.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fctm360-exposes-fake-gift-card-scams-exploiting-trusted-brands\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F11\u002F06\u002Fctm360-gift-card-scam.jpg","2026-11-07T14:10:19+00:00","2026-11-07T15:00:14.561589+00:00",7,[17,20,23,25,27,29],{"name":18,"type":19},"CTM360","vendor",{"name":21,"type":22},"PlayStation","product",{"name":24,"type":22},"Sephora",{"name":26,"type":22},"SHEIN",{"name":28,"type":22},"Walmart",{"name":30,"type":22},"Amazon","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},[40],{"type":41,"value":42,"context":43},"url","https:\u002F\u002Fwww.ctm360.com\u002Freports\u002Fgift-card-scams","Link to the full report on gift card scams",[18,21,24],{"controls":46,"vendors":130},[47,75,104],{"slug":35,"name":48,"problem":49,"products":50},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"slug":76,"name":77,"problem":78,"products":79},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"slug":105,"name":106,"problem":107,"products":108},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[109,116,122],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":105,"product_name":113,"url":114,"description":115},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":117,"product_name":118,"url":120,"description":121},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":143},"fake-gift-card-scams-exploit-brand-trust-to-steal-personal-data","Fake Gift Card Scams Exploit Brand Trust to Steal Personal Data","Cybercriminals launched a large-scale social engineering campaign impersonating well-known brands and celebrities to lure victims into fake gift card giveaways. Victims were guided through deceptive verification steps that harvested personal information, installed unwanted apps, and enrolled them in fraudulent subscriptions. The campaign monetized through affiliate networks, amplifying its reach and financial damage across over 1,000 documented incidents. This matters because it demonstrates how easily consumer trust in recognizable brands can be weaponized, and how low technical sophistication is needed when human psychology is the primary attack vector.",[136,137,138,139,140,141,142],"CIS Control 14: Security Awareness and Skills Training","MITRE ATT&CK T1566: Phishing","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","GDPR Article 32","ISO\u002FIEC 27001:2022 Clause 7.2: Competence","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"GDPR Article 32":144,"NIS2 Article 21(2)(b)":145,"MITRE ATT&CK T1566: Phishing":146,"ISO\u002FIEC 27001:2022 Clause 7.2: Competence":147,"CIS Control 17: Incident Response Management":148,"CIS Control 14: Security Awareness and Skills Training":149,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":150},"Personal information stolen through fraudulent verification steps constitutes a data protection failure, and organizations whose brand was impersonated must have controls to limit such unauthorized data collection targeting their customers.","NIS2 requires organizations to implement incident handling measures; detecting and responding to brand impersonation campaigns at scale requires defined procedures that this article mandates for entities in scope.","The campaign used phishing-style lures — fake gift card pages impersonating trusted brands — to harvest credentials and personal information, mapping directly to this technique.","Users lacked the competence to distinguish legitimate promotions from scams, underscoring the need for organizations to invest in building security awareness and literacy among their customer base and staff.","With over 1,000 incidents reported, a formal incident response process including brand abuse reporting workflows and coordination with hosting providers is essential to contain and remediate ongoing scam campaigns quickly.","Victims fell for social engineering because they lacked the awareness to recognize fake brand impersonation tactics; structured user education would reduce susceptibility to these deceptive verification schemes.","Victims were deceived partly because there was no authenticated, verifiable channel proving legitimate brand promotions, highlighting the need for verified identity signals in consumer-facing communications."]