Loading threat actor…
Jingle Thief is a financially motivated cybercrime group focused on gift card fraud through cloud identity compromise and abuse of Microsoft 365 environments. The activity has been tracked as CL-CRI-1032 and has been assessed with moderate confidence to overlap with actors publicly reported as Atlas Lion and STORM-0539. The group has been active since at least 2021 and is assessed with moderate confidence to operate from Morocco. Jingle Thief primarily targets global retail and consumer services organizations, especially enterprises that rely heavily on cloud-based infrastructure and maintain internally accessible gift card issuance workflows. Its operations are notable for minimizing traditional malware use and instead living largely within legitimate cloud services such as Exchange Online, SharePoint, OneDrive, and Microsoft Entra ID. The group typically begins with tailored phishing or smishing to steal Microsoft 365 credentials, then uses the compromised identities to impersonate legitimate users and blend into normal business activity. After initial access, the actors conduct extensive cloud reconnaissance, including searching SharePoint and OneDrive for internal documentation related to gift card issuance, ticketing systems, remote access procedures, and approval workflows. They expand access through internal phishing sent from compromised accounts, often impersonating trusted colleagues or internal IT notifications, in order to capture additional credentials and reach higher-privileged accounts. Observed intrusions have involved long dwell times and broad account compromise, including one case lasting roughly ten months and affecting more than sixty user accounts. For persistence and defense evasion, Jingle Thief abuses legitimate Entra ID self-service and device enrollment features. Reported techniques include registering rogue authenticator applications, resetting passwords through self-service flows, and enrolling attacker-controlled devices to preserve access even after password resets or session revocation. The group also manipulates Exchange mailbox rules and message handling to passively monitor victim communications, particularly around gift card approvals, financial workflows, and IT account changes, while hiding evidence by moving phishing messages and replies out of normal user view. The group’s end goal is unauthorized issuance of high-value gift cards for resale and monetization. Activity has been observed to intensify during holiday periods, when retail gift card volume is higher and staffing may be reduced. Jingle Thief is best characterized as a cloud-centric cybercrime actor specializing in identity abuse, stealthy persistence, internal phishing, and fraud operations against retail and consumer-facing enterprises.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Financially motivated cloud intrusions to obtain access sufficient to issue unauthorized gift cards for resale/monetization.
Morocco-based cybercrime operation conducting large-scale gift card fraud by operating primarily inside victim cloud environments (notably Microsoft 365/Entra ID). Uses credential theft and internal phishing to gain higher privileges, then abuses gift card issuance workflows to generate high-value gift cards for resale; maintains long dwell time via Entra ID self-service abuse (rogue authenticator app/device enrollment).
Gift card fraud operation leveraging Microsoft 365 identity abuse to steal hundreds of thousands of dollars.
Jingle Thief is a financially motivated threat actor targeting retailers and service providers that issue gift cards. The group specializes in phishing and identity misuse to gain access to cloud accounts, particularly Microsoft 365, and abuses internal workflows to issue or redeem high-value gift cards. Their operations are timed around retail peaks to maximize impact and evade detection.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.