Cybersecurity researchers have make clear a cybercriminal group referred to as Jingle Thief that has been noticed concentrating on cloud environments related to organizations within the retail and client providers sectors for present card fraud.
“Jingle Thief attackers use phishing and smishing to steal credentials, to compromise organizations that difficulty present playing cards,” Palo Alto Networks Unit 42 researchers Stav Setty and Shachar Roitman mentioned in a Wednesday evaluation. “As soon as they achieve entry to a company, they pursue the sort and degree of entry wanted to difficulty unauthorized present playing cards.”
The top aim of those efforts is to leverage the issued present playing cards for financial achieve by seemingly reselling them on grey markets. Reward playing cards make for a profitable selection as they are often simply redeemed with minimal private info and are troublesome to hint, making it tougher for defenders to research the fraud.
The title Jingle Thief is a nod to the menace actor’s sample of conducting present card fraud coinciding with festive seasons and vacation durations. The cybersecurity firm is monitoring the exercise underneath the moniker CL‑CRI‑1032, the place “CL” stands for cluster and “CRI” refers to legal motivation.
The menace cluster has been attributed with reasonable confidence to legal teams tracked as Atlas Lion and Storm-0539, with Microsoft describing it as a financially motivated crew originating from Morocco. It is believed to be energetic since a minimum of late 2021.
Jingle Thief’s means to keep up footholds inside compromised organizations for prolonged durations, in some circumstances for over a 12 months, makes it a harmful group. Throughout the time it spends with the environments, the menace actor conducts in depth reconnaissance to map the cloud setting, strikes laterally throughout the cloud, and takes steps to sidestep detection.
Unit 42 mentioned it noticed the hacking group launching a wave of coordinated assaults concentrating on numerous world enterprises in April and Might 2025, utilizing phishing assaults to acquire credentials essential to breach victims’ cloud infrastructure. In a single marketing campaign, the attackers are mentioned to have maintained entry for about 10 months and damaged into 60 consumer accounts inside a single group.
“They exploit cloud-based infrastructure to impersonate professional customers, achieve unauthorized entry to delicate knowledge, and perform present card fraud at scale,” the researchers famous.
The assaults typically contain makes an attempt to entry present‑card issuance purposes to difficulty excessive‑worth playing cards throughout completely different packages, whereas concurrently making certain these actions go away minimal logs and forensic trails.
Jingle Thief phishing assault chain throughout Microsoft 365
They’re additionally extremely focused and tailor-made to every sufferer, with the menace actors finishing up reconnaissance earlier than sending persuasive phishing login pages by way of electronic mail or SMS that may idiot victims and trick them into coming into their Microsoft 365 credentials.
As quickly because the credentials are harvested, the attackers waste no time logging into the setting and perform a second spherical of reconnaissance, this time concentrating on the sufferer’s SharePoint and OneDrive for info associated to enterprise operations, monetary processes, and IT workflows.
This consists of trying to find present card issuance workflows, VPN configurations and entry guides, spreadsheets or inner methods used to difficulty or monitor present playing cards, and different key particulars associated to digital machines and Citrix environments.
Within the subsequent part, the menace actors have been discovered to leverage the compromised account to ship phishing emails internally throughout the group to broaden their foothold. These messages typically mimic IT service notifications associated to IT service notifications or ticketing updates by making use of data gleaned from inner documentation or earlier communications.
Moreover, Jingle Thief is thought to create inbox guidelines to mechanically ahead emails from hacked accounts to addresses underneath their management, after which cowl up traces of the exercise by shifting the despatched emails instantly to Deleted Gadgets.
In some circumstances, the menace actor has additionally been noticed registering rogue authenticator apps to bypass multi-factor authentication (MFA) protections and even enrolling their units in Entra ID in order to keep up entry even after victims’ passwords are reset or the session tokens are revoked.
Moreover their unique give attention to cloud providers reasonably than endpoint compromise, one other side that makes Jingle Thief’s campaigns noteworthy is their propensity for id misuse over deploying customized malware, thereby minimizing the possibilities of detection.
“Reward card fraud combines stealth, velocity and scalability, particularly when paired with entry to cloud environments the place issuance workflows reside,” Unit 42 mentioned. “This discreet strategy helps evade detection whereas laying the groundwork for future fraud.”
“To take advantage of these methods, the menace actors want entry to inner documentation and communications. They’ll safe this by stealing credentials and sustaining a quiet, persistent presence inside Microsoft 365 environments of focused organizations that present present card providers.”
