Jingle Thief Hackers Exploit the Festive Season with Weaponized Gift Card Scams

Jingle Thief is a campaign identified by security researchers as targeting global retail and consumer services organisations through credential theft and gift card fraud, with threat actors operating from Morocco and active since 2021. According to Unit 42, the operation is tracked as cluster CL-CRI-1032 and overlaps with threat groups publicly known as Atlas Lion and STORM-0539, representing a persistent risk to enterprise cloud infrastructure.

The attackers rely on phishing and SMS-based smishing to obtain cloud credentials, then operate almost exclusively within cloud environments using Microsoft 365 features to impersonate legitimate users and conduct large‑scale fraud. In one observed campaign, they maintained access for about 10 months and compromised over 60 user accounts within a single global enterprise.

They map victim environments and gift card issuance workflows, and use internal phishing, forwarded rules, and passive monitoring to facilitate fraudulent gift card activity, especially during the festive season when staffing and transaction volumes rise. The analysis highlights the shift toward identity-based detection and monitoring of user behaviour and login patterns to detect these sophisticated, long‑running campaigns.