Bitdefender Labs has identified an ongoing scam campaign on Meta platforms targeting users in the EU and the US with fraudulent “Olympics Shop” advertisements promising discounts of up to 80% on Milano Cortina 2026 merchandise.
The ads use official Olympic imagery, polished product photos, and promotional messages that closely resemble legitimate marketing.
Users who click the ads are redirected to cloned versions of the official Olympics merchandise store. These websites are designed to collect payment card data and personal information such as names, addresses, phone numbers, and email accounts.
In some cases, login credentials may also be requested.
Victims may receive counterfeit products or no merchandise at all, and the sites often disappear soon after transactions are processed.
Why It Matters: Major sporting events drive surges in online shopping and advertising activity across digital platforms. This campaign shows how threat actors can blend into that activity by using paid ads and lookalike websites to redirect transactions and capture consumer data before detection systems remove them.
- Convincing Ads That Mirror Official Promotions: The Meta advertisements feature official Olympic branding and promotional language such as “Up to 80% OFF” and “30 Days No Excuse Free Return,” including versions in multiple languages. The presentation closely resembles authentic campaigns, making the offers appear credible at first glance.
- Near-Perfect Replicas of the Official Store: The fraudulent sites copy product images, merchandise collections, color schemes, branding elements, and layout structure from the legitimate Olympics Shop. One visible difference is the discount message. The official store promotes “Sign up & Save 15%,” while the scam versions advertise “Sign & Save 80%.” Minor font differences and layout inconsistencies may also appear.
- Clusters of Newly Registered Lookalike Domains: Bitdefender researchers observed numerous domains registered within days of each other, using extensions such as .store, .shop, .top, and .com. Additional domains continue to appear. In some cases, ads display what appears to be the official shop preview while redirecting users to a fraudulent domain after the click. All identified domains have been flagged as malicious by Bitdefender systems.
- New Facebook Pages Launching Paid Campaigns: Several of the Facebook pages running these ads were created the same day as the associated domains. This timing indicates a tightly coordinated deployment cycle where social accounts and web infrastructure are stood up in parallel, enabling attackers to begin monetizing traffic immediately. The short lifespan of these pages reduces exposure to enforcement actions while maintaining a steady flow of replacement assets.
- Financial and Data Exposure for Consumers: Users who complete purchases risk losing payment card details and personal data. Some operations may also capture account credentials. The fraudulent sites often go offline after processing payments, leaving victims without merchandise or recovery options. Bitdefender advises verifying domain names carefully, questioning extreme discounts, reviewing page transparency information, and using security tools to analyze suspicious links before entering sensitive information.
Trusted insights for technology leaders
Our readers are CIOs, CTOs, and senior IT executives who rely on The National CIO Review for smart, curated takes on the trends shaping the enterprise, from GenAI to cybersecurity and beyond.
Subscribe to our 4x a week newsletter to keep up with the insights that matter.
