Loading story…
Misconfigurations in IT environments continue to be a leading cause of cyber breaches, as highlighted by security experts who emphasize that simple errors such as open cloud storage, default credentials, and improper access controls are frequently exploited by attackers. Security leaders urge organizations to prioritize configuration management and align with compliance frameworks like NIST, CIS, HIPAA, and ISO 27001 to reduce risk exposure. Tools such as ThreatLocker's Defense Against Configurations (DAC) are being developed to help organizations identify and remediate these vulnerabilities before they can be exploited.
A recent large-scale cybercrime campaign, dubbed 'Jingle Thief,' demonstrates the real-world impact of these weaknesses, particularly in the retail sector. The Morocco-based group targets global retailers by leveraging stolen Microsoft 365 credentials to infiltrate cloud environments, maintain long-term access, and generate fraudulent gift cards for resale. Attackers often remain undetected for months, compromising dozens of accounts and using legitimate tools to evade detection, underscoring the urgent need for robust configuration management and credential security in cloud-based infrastructures.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
On publication of its findings, Unit 42 described the campaign as 'Jingle Thief' and attributed it to a Morocco-based cybercrime group. The report detailed how the actors used phishing or smishing, SharePoint and OneDrive reconnaissance, internal phishing, and abuse of Microsoft Entra ID self-service features to persist in victim environments.
Palo Alto Networks Unit 42 identified a large-scale campaign targeting global retailers and consumer services firms that rely heavily on cloud infrastructure. In at least one case, the attackers maintained access for 10 months by compromising dozens of employee Microsoft 365 accounts and blending in with normal business activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A financially motivated threat group operating out of Morocco has orchestrated a sophisticated campaign, dubbed Jingle Thief, targeting global retailers and businesses that issue gift cards. The attackers focus on exploiting cloud-based infrastructure, particularly Microsoft 365 environments, to conduct large-scale gift card fraud, especially during festive seasons when such fraud is more lucrative. The campaign begins with spear-phishing and smishing attacks aimed at harvesting employee credentials through convincing fake login portals that mimic legitimate services. Once initial access is gained, the attackers authenticate directly to Microsoft 365, bypassing traditional malware and endpoint-based techniques. They conduct extensive reconnaissance within the compromised environment, searching file shares, OneDrive, and SharePoint for documents related to gift card issuance workflows, ticketing systems, and internal processes. The attackers also seek out VPN configuration files and virtual machine access guides to deepen their foothold. Persistence is maintained by compromising additional accounts through internal phishing, leveraging the trust inherent in internal communications. The attackers use stealthy tactics, such as moving sent phishing emails and user replies to Deleted Items, to evade detection by both users and security teams. Their operations are notable for the ability to remain undetected within organizations for extended periods, sometimes exceeding a year, allowing them to gain deep familiarity with internal systems and processes. The campaign has been observed to launch coordinated attacks across multiple enterprises, with a particular focus on those heavily reliant on cloud services. The threat actors behind Jingle Thief are tracked as cluster CL-CRI-1032 by Unit 42 and are believed to overlap with groups known as Atlas Lion and STORM-0539. The attackers' cloud-only approach, avoiding malware and endpoint compromise, makes detection and remediation particularly challenging for targeted organizations. The campaign highlights the growing risk of identity-based attacks in cloud environments, where user credentials are the primary target. Security researchers emphasize the need for robust identity and access management, vigilant monitoring of cloud activity, and user education to mitigate such threats. The incident underscores the evolving tactics of financially motivated threat actors and the importance of adapting security strategies to address cloud-native attack vectors. Organizations are advised to review their gift card issuance processes, strengthen multi-factor authentication, and monitor for unusual access patterns in cloud services. The Jingle Thief campaign serves as a warning of the increasing sophistication and persistence of cloud-focused cybercriminals targeting the retail sector.
Jun 29, 2026
A recent Amazon Web Services (AWS) report, produced in collaboration with Vanson Bourne, highlights that compromised credentials and misconfigurations are among the top causes of security incidents in public cloud environments. The report, based on a survey of 2,800 technology and security firms across 13 countries, found that vulnerability exploitation accounted for 24% of cloud security incidents, while compromised credentials were responsible for 20%. Physical theft and misconfigurations followed at 19% and 16%, respectively. The findings emphasize that as organizations rapidly migrate applications and data to the cloud, human factors and operational errors remain significant contributors to breaches, with nearly 80% of organizations reporting a data breach in the past year, whether on-premises or in the cloud. Experts cited in the report stress the critical need for identity-aware security strategies, such as microsegmentation, to limit attackers' ability to exploit valid accounts and move laterally within compromised networks. The convergence of cloud persistence, token replay attacks, and traditional malware techniques has increased the risk landscape, making it essential for organizations to address identity security debt and implement robust controls to protect cloud environments. The report also notes that while confidence in cloud adoption is high, cybersecurity and privacy concerns remain the primary barriers for many organizations, underscoring the importance of continuous vigilance and proactive security measures in cloud operations.
Jul 12, 2026
**Credential compromise** and identity abuse are increasing as attackers rely more on stolen logins, session artifacts, and phishing rather than noisy exploitation alone. Recorded Future reported a sharp rise in exposed credentials during 2025, including nearly **2 billion** credentials indexed from malware combo lists, with the second half of the year up **50%** over the first and Q4 up **90%** over Q1. The trend is being driven by the industrialization of **infostealer malware**, malware-as-a-service ecosystems, and AI-enabled phishing and social engineering, while weak identity governance continues to expand the attack surface. A separate survey of UK organizations found **77%** fail to promptly disable former employees' accounts, **34%** grant overly broad access, and many still use manual processes such as spreadsheets for account validation, creating persistent opportunities for unauthorized access. A targeted phishing attempt against **Outpost24** illustrates how these identity-focused attacks are being operationalized against even security vendors. Attackers used a convincing fake JP Morgan email, valid **DKIM** authentication via Amazon SES infrastructure, and a **seven-stage redirect chain** leveraging trusted brands including Cisco to steer a C-suite executive toward a Microsoft Office credential-harvesting page while evading email defenses. The broader threat environment shows the same shift toward access abuse and stealthier post-compromise tradecraft: Google Threat Intelligence Group found ransomware actors increasingly favor native Windows tools over **Cobalt Strike**, with data theft present in **77%** of incidents and exploitation of VPNs and firewalls still common for initial access. Together, the reporting shows attackers are increasingly **logging in rather than breaking in**, then using legitimate access and built-in tools to deepen compromise and extort victims.
Jun 29, 2026