Black Friday scammers offer fake gifts from big-name brands to empty bank accounts
Inside a massive malicious ad campaign that mimics brands like LEGO, Lululemon, and Louis Vuitton to trick shoppers into handing over bank details.
Black Friday is supposed to be chaotic, sure, but not this chaotic.
While monitoring malvertising patterns ahead of the holiday rush, I uncovered one of the most widespread and polished Black Friday scam campaigns circulating online right now.
It’s not a niche problem. Our own research shows that 40% of people have been targeted by malvertising, and more than 1 in 10 have fallen victim, a trend that shows up again and again in holiday-season fraud patterns. Read more in our 2025 holiday scam overview.
Through malicious ads hidden on legitimate websites, users are silently redirected into an endless loop of fake “Survey Reward” pages impersonating dozens of major brands.
What looked like a single suspicious redirect quickly turned into something much bigger. One domain led to five more. Five led to twenty. And as the pattern took shape, the scale became impossible to ignore: more than 100 unique domains, all using the same fraud template, each swapping in different branding depending on which company they wanted to impersonate.
This is an industrialized malvertising operation built specifically for the Black Friday window.
The brands being impersonated
The attackers deliberately selected big-name, high-trust brands with strong holiday-season appeal. Across the campaign, I observed impersonations of:
- Walmart
- Home Depot
- Lowe’s
- Louis Vuitton
- CVS Pharmacy
- AARP
- Coca-Cola
- UnitedHealth Group
- Dick’s Sporting Goods
- YETI
- LEGO
- Ulta Beauty
- Tourneau / Bucherer
- McCormick
- Harry & David
- WORX
- Northern Tool
- POP MART
- Lovehoney
- Petco
- Petsmart
- Uncharted Supply Co.
- Starlink (especially the trending Starlink Mini Kit)
- Lululemon / “lalubu”-style athletic apparel imitators
These choices are calculated. If people are shopping for a LEGO Titanic set, a YETI bundle, a Lululemon-style hoodie pack, or the highly hyped Starlink Mini Kit, scammers know exactly what bait will get clicks.
In other words: They weaponize whatever is trending.
How the scam works
1. A malicious ad kicks off an invisible redirect chain
A user clicks a seemingly harmless ad—or in some cases, simply scrolls past it—and is immediately funneled through multiple redirect hops. None of this is visible or obvious. By the time the page settles, the user lands somewhere they never intended to go.
2. A polished “Survey About [Brand]” page appears
Every fake site is built on the same template:
- Brand name and logo at the top
- A fake timestamp (“Survey – November X, 2025
Read More
What's Your Reaction?
