Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign
Summary: Unit 42 documented a financially motivated Morocco-based campaign it calls Jingle Thief, tracked as cluster CL-CRI-1032, that uses phishing and smishing to steal credentials from retail and consumer services enterprises and then exploits Microsoft 365 to issue unauthorized gift cards. In one observed intrusion, attackers held access for roughly 10 months and compromised over 60 user accounts within a single global enterprise, using SharePoint, OneDrive, Exchange and Entra ID while aligning activity with holiday periods.
What's compelling: The actors maintained a foothold for about a year and enrolled rogue devices in Entra ID so access survived password resets and session revocation - meaning the gift card fraud was the last step in a long, quiet presence your identity controls did not stop.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026