The free gift card shows you four characters of the code, and never the rest

The ad seems to come from MrBeast, or from Alix Earle, and the page behind it looks like PlayStation, Sephora or Walmart. A counter shows how many people have already claimed, a timer runs down, and a row of recent winners smiles back at you. You pick a value, an animation spins, and a code appears with just four characters visible: XXXX-XXXX-7F3A-XXXX. To see the rest, you only need to pass a quick security check.

That check is the whole business. The threat intelligence firm CTM360 says in a new report that it has counted more than 1,000 incidents tied to this one recurring campaign, using brands such as PlayStation, Google Play, Sephora, SHEIN, Walmart and Amazon. The "Human Verification" step walks people through surveys and quizzes, asks them to install an app or a browser extension, or to type in a mobile number and then the PIN that arrives by text. That PIN confirms a paid subscription billed to the phone. The links carry affiliate tags, so whoever runs the page earns a commission each time someone completes a step. In every flow CTM360 tested, no gift card was delivered. The site just reports the task as incomplete and offers another.

The brands and celebrity faces are swapped constantly, so blocking one site achieves little. The rule that holds up: a company giving away real gift cards has no reason to make you install anything or confirm a code sent to your phone. If you've already entered a PIN on one of these pages, look at your next mobile bill for a premium service you never asked for, and ask your carrier to cancel it and block premium charges. If an extension came along, remove it.

If your browser has started opening strange pages or swapped its search engine since, Tendvane's "browser hijacked" repair wizard and its Safety check for unwanted software are a quick way to find what got installed along the way.