Amazon Gift Card Lures Weaponized to Steal Microsoft Credentials

In the digital era, e-gift cards have become a staple for personal and corporate gifting, prized for their instant delivery and the flexibility they offer recipients.

But this very convenience is being weaponized by cybercriminals, as demonstrated by a recent credential phishing campaign detected by the Cofense Phishing Defense Center (PDC).

The latest attack leverages a convincing Amazon e-gift card ruse, purportedly sent by employers as a reward for outstanding performance, to trick victims into relinquishing their Microsoft login credentials.

Spoofed Emails Masquerade as Employer Rewards

The attack begins with an expertly crafted phishing email, spoofed to appear as a message from a legitimate workplace rewards program such as “Reward Gateway.”

The email entices recipients with the promise of a $200 Amazon e-gift card, framing it as a reward for exceptional work.

A convincing call-to-action button and a purported eGift card URL further shepherd victims toward the next phase.

Critically, the email contains language that praises the recipient’s job performance, heightening trust and lowering skepticism.

Once the recipient clicks the provided link or button, they are directed to a fraudulent Amazon gift card redemption site hosted on the domain activationshub[.]com.

This domain, created just days before the campaign was discovered, has no association with Amazon and is a clear anomaly to the trained eye.

Nonetheless, it closely mimics the look and feel of a legitimate Amazon redemption page, instructing users to submit their email address to continue.

Upon entering their email, targets are seamlessly redirected to a convincing, but entirely fraudulent, Microsoft login page.

The phishing page, hosted on officefilecenter[.]com (another newly registered domain with no connection to Microsoft), is designed to harvest Microsoft account credentials.

The visual cues and branding closely resemble legitimate Microsoft Outlook or Office 365 login pages, masking the attack’s true intent.

Notably, authentic Microsoft authentication portals will always use official domains such as live.com or outlook.com.

Emotional Manipulation and High Monetary Temptations

By exploiting both the excitement and urgency associated with receiving a sizable reward, threat actors manipulate recipients into moving quickly and bypassing standard security checks.

According to the Report, The campaign’s sophistication increases the likelihood of a successful compromise, particularly in high-trust environments where employees are accustomed to digital communication from their organizations.

This campaign highlights the evolving techniques used by cybercriminals to exploit common corporate incentives and trusted platforms.

The Cofense PDC continues to monitor such threats, leveraging advanced detection tools to mitigate phishing risks for its clients.

Users are reminded to carefully examine URLs and sender addresses before entering sensitive credentials and to be wary of unexpected rewards, even if they appear to come from trusted sources.

Indicators of Compromise

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates