A threat campaign tries to attract shoppers to bogus websites that steal shoppers’ real personal information.