Halloween-themed scams are targeting users across the United States, Canada and Europe through fraudulent emails, SMS messages, social media advertisements and fake shopping websites, according to cybersecurity researchers at Bitdefender Labs.
The researchers identified multiple campaigns between September 1 and October 22, 2026, involving fake giveaways, discounted products and phishing links designed to steal personal and financial information.
The campaigns impersonating Costco and Tractor Supply were primarily aimed at US users, who accounted for 73% of observed targeting. Romania represented 9%, followed by Ireland at 5%, Germany at 4% and Hungary at 3%. Neither retailer was associated with the fraudulent offers.
Other campaigns impersonated Dutch and Belgian retailer bol.com, promising a €250 gift card through a fake giveaway. Separate emails advertised cash rewards, gambling bonuses and a Samsung 65-inch 4K television in exchange for completing surveys. Such schemes can lead victims to disclose personal details or payment information, sometimes under the pretext of paying a small delivery fee.
Researchers also flagged suspicious online stores advertising discounted Halloween costumes, masks, jewellery and decorations. In Canada, SMS campaigns offered fake lottery winnings and expiring reward points, while other messages promoted fictional deposits and Halloween party invitations containing phishing links. A separate campaign used a Halloween-themed workbook as bait.
Cybercriminals are also exploiting seasonal cryptocurrency promotions to lure investors with promises of quick profits and exclusive token launches, potentially exposing buyers to pump-and-dump schemes.
Bitdefender Labs advised users to avoid clicking unsolicited links, downloading unexpected files or sharing financial information to claim prizes. Consumers should verify offers through official websites or applications and check unfamiliar shopping domains before making payments.
Researchers warned that festive designs, familiar brand logos and urgent deadlines do not guarantee legitimacy. Independently verifying seasonal promotions remains essential to avoiding online fraud.
