Gift Card Stash Scam Targets Holiday Shoppers

Gift Card Stash Scam Targets Holiday Shoppers

Alpha Team has identified a series of new scam sites that lure victims into divulging personal information in exchange for gift card codes. The sites, which go by the name “Gift Card Stash” or “GC Stash,” claim that they use random number generators along with a validity checker of some undisclosed kind, in order to verify that the card code is genuine. Ultimately, victims never receive cards - they are instead subjected to scam survey purgatory, where they are prompted to enter personal information and answer bogus surveys until they exit the page.

Recommendations

• Use caution when interacting with promotional sites, especially when asked to provide sensitive personal information. If a promotion sounds too good to be true, it probably is. Consider using a separate email for promotional entries
• Whenever possible, enable multi-factor authentication. Ideally, this should be using an application such as Duo or Google Authenticator, as SMS codes can be intercepted
• Always verify that the domain you are visiting matches what you would expect, particularly when clicking through links in web searches
• Consider enabling the compromised credentials rule for relevant entities, and ensure relevant emails are entered for these entities. Reach out to [email protected] for assistance, if needed

Details

A new gift card scam has popped onto the scene, just in time for the holidays. This time, Twitter bot accounts are being used to push scam websites that claim to generate free, legal ecodes for gaming stores like Nintento eShop, xBox, and Steam. The sites also advertise the same service for Amazon, Sephora, Lowes, PayPal, and many others.

**Figure 1. ** Social media post advertising scam site

Figure 2. Home page of GC Stash/Gift Card Stash sites

Navigating to the link in the post takes users to a site where they are prompted to select the site for which they would like to generate a gift card code, and the amount of their choosing - either $25, $50, or $100.

Figure 3. Users are prompted to choose an amount for the site in question

The gift card amounts remain the same for all options given to the user. Clicking one of these options brings users to a popup that claims to be in the process of generating a code. Ultimately, the user is asked to verify their humanity, and is given a choice of options to do this. Each of these options directs users to a scam survey site, where they are directed to input a variety of personal information and answer dozens of questions. Ultimately, the verification process is never finalized. Users are prompted to answer survey after survey until they get frustrated and exit the page.

Conclusion

Gift card scams spike every year around the holidays, when attackers take advantage of the gift giving season to lure holiday shoppers into falling for these scams. It is always important to keep in mind that promises of something for nothing are likely false promises. Never give personal information out to sites that you have not fully vetted.

IOCs

getprize[.]site
promocodeall[.]com
nucode[.]site
giftcodes[.]pw
gamer-evolution-tools[.]live
itunes[.]codigosmania[.]com
codigosdesteamgratis[.]direzi[.]com
gelatocards[.]com
steamgiftcards[.]mobi
playcode[.]site
paypal[.]freehax[.]cc
amazon[.]playhacks[.]net
spotify[.]playhacks[.]net
codegift[.]club
onlinepromotionsusa[.]com
giftcardstash.xyz
giftcardfree[.]website
gcstash[.]club

ThreatFeed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/116/list_indicators/