Loading story…
A financially motivated threat group operating out of Morocco has orchestrated a sophisticated campaign, dubbed Jingle Thief, targeting global retailers and businesses that issue gift cards. The attackers focus on exploiting cloud-based infrastructure, particularly Microsoft 365 environments, to conduct large-scale gift card fraud, especially during festive seasons when such fraud is more lucrative. The campaign begins with spear-phishing and smishing attacks aimed at harvesting employee credentials through convincing fake login portals that mimic legitimate services. Once initial access is gained, the attackers authenticate directly to Microsoft 365, bypassing traditional malware and endpoint-based techniques. They conduct extensive reconnaissance within the compromised environment, searching file shares, OneDrive, and SharePoint for documents related to gift card issuance workflows, ticketing systems, and internal processes. The attackers also seek out VPN configuration files and virtual machine access guides to deepen their foothold. Persistence is maintained by compromising additional accounts through internal phishing, leveraging the trust inherent in internal communications. The attackers use stealthy tactics, such as moving sent phishing emails and user replies to Deleted Items, to evade detection by both users and security teams. Their operations are notable for the ability to remain undetected within organizations for extended periods, sometimes exceeding a year, allowing them to gain deep familiarity with internal systems and processes. The campaign has been observed to launch coordinated attacks across multiple enterprises, with a particular focus on those heavily reliant on cloud services. The threat actors behind Jingle Thief are tracked as cluster CL-CRI-1032 by Unit 42 and are believed to overlap with groups known as Atlas Lion and STORM-0539. The attackers' cloud-only approach, avoiding malware and endpoint compromise, makes detection and remediation particularly challenging for targeted organizations. The campaign highlights the growing risk of identity-based attacks in cloud environments, where user credentials are the primary target. Security researchers emphasize the need for robust identity and access management, vigilant monitoring of cloud activity, and user education to mitigate such threats. The incident underscores the evolving tactics of financially motivated threat actors and the importance of adapting security strategies to address cloud-native attack vectors. Organizations are advised to review their gift card issuance processes, strengthen multi-factor authentication, and monitor for unusual access patterns in cloud services. The Jingle Thief campaign serves as a warning of the increasing sophistication and persistence of cloud-focused cybercriminals targeting the retail sector.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Unit 42 published research on the cloud-based gift card fraud campaign, tracking it as CL-CRI-1032 and noting overlap with publicly reported Atlas Lion and STORM-0539 activity. The report detailed the actors' use of phishing, internal cloud abuse, mailbox manipulation, and Entra ID self-service/device enrollment features for persistence.
During April and May 2025, Unit 42 observed a coordinated wave of attacks affecting multiple global enterprises. In one case, the activity involved more than 60 compromised user accounts and was aimed at enabling unauthorized issuance of high-value gift cards.
In at least one observed intrusion, the attackers retained access to a victim environment for roughly 10 months while abusing Microsoft 365 and Entra ID features for persistence and stealth. This indicates the campaign was capable of sustained, low-noise cloud-based compromise.
Unit 42 assessed with moderate confidence that the actors behind the "Jingle Thief" campaign have been active since 2021. The group focused on financially motivated gift card fraud, particularly targeting retailers around holiday periods.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceforesiet.com
Open sourceunit42.paloaltonetworks.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Misconfigurations in IT environments continue to be a leading cause of cyber breaches, as highlighted by security experts who emphasize that simple errors such as open cloud storage, default credentials, and improper access controls are frequently exploited by attackers. Security leaders urge organizations to prioritize configuration management and align with compliance frameworks like NIST, CIS, HIPAA, and ISO 27001 to reduce risk exposure. Tools such as ThreatLocker's Defense Against Configurations (DAC) are being developed to help organizations identify and remediate these vulnerabilities before they can be exploited. A recent large-scale cybercrime campaign, dubbed 'Jingle Thief,' demonstrates the real-world impact of these weaknesses, particularly in the retail sector. The Morocco-based group targets global retailers by leveraging stolen Microsoft 365 credentials to infiltrate cloud environments, maintain long-term access, and generate fraudulent gift cards for resale. Attackers often remain undetected for months, compromising dozens of accounts and using legitimate tools to evade detection, underscoring the urgent need for robust configuration management and credential security in cloud-based infrastructures.
Jun 29, 2026
A sophisticated, multi-stage phishing campaign has been observed targeting organizations globally to steal Microsoft 365 credentials. The operation, monitored since early November 2025, employs advanced evasion techniques such as nested PDFs, use of legitimate content delivery networks, and mouse tracking to bypass secure email gateways and multi-factor authentication. The final credential harvesting site is engineered to block security tools and analysts, and leverages legitimate Microsoft infrastructure to circumvent MFA, granting attackers immediate access to compromised accounts. These attacks highlight the increasing complexity of phishing operations and their ability to evade traditional security controls. In parallel, threat actors are exploiting free cloud hosting platforms like Cloudflare Pages to host convincing phishing portals impersonating banking and healthcare providers. These sites not only harvest credentials but also collect additional security information, such as answers to secret questions, and exfiltrate data via Telegram bots to evade detection. Attackers use compromised legitimate domains as redirectors, increasing the likelihood of bypassing spam filters and making takedown efforts more challenging. The convergence of advanced phishing techniques and abuse of trusted cloud services underscores the need for enhanced detection and response strategies for organizations relying on Microsoft 365 and similar platforms.
Jun 29, 2026
Threat actors have intensified phishing operations by leveraging complex email routing techniques and exploiting domain misconfigurations to successfully spoof trusted brands. These campaigns manipulate email infrastructure weaknesses, allowing attackers to send convincing phishing emails that appear to originate from legitimate domains, thereby increasing the likelihood of user engagement and credential compromise. Security researchers have observed that such tactics are being used to bypass traditional email security controls, making detection and prevention more challenging for organizations. During the holiday season, attackers combined these advanced spoofing methods with social engineering, sending emails that mimic Docusign notifications and Christmas-themed documents to exploit user trust and seasonal distractions. Victims are redirected through multiple hosting platforms before landing on credential harvesting sites, and a secondary wave of attacks targets personal financial data through fake loan application forms. The campaigns demonstrate a sophisticated use of both technical and psychological tactics to maximize the impact on both corporate and individual targets.
Jun 29, 2026