'Jingle Thief' Highlights Retail Cyber Threats

A Morocco-based gift card fraud campaign called “Jingle Thief” highlights the kind of threats retailers may face this holiday season, researchers say, with the operation primarily targeting global retailers and consumer services that rely on cloud infrastructure.

The attackers maintain a stealthy, months-long presence after gaining initial access, and in one observed intrusion lurked undetected for 10 months while compromising more than 60 employee accounts using Microsoft 365 tools to masquerade as legitimate users, according to Unit 42.

A typical Jingle Thief attack begins with a tailored phishing or smishing effort to harvest Microsoft 365 credentials, after which the thieves search victim cloud environments for gift card workflows, ticketing systems, VPN configurations and card issuance procedures.

They then pursue higher-privileged access through internal phishing and by exploiting legitimate self-service features in Microsoft’s Entra ID platform to register rogue authenticator apps and enroll attacker-controlled devices, allowing continued access even when passwords are reset.

The campaign is part of a wider pattern of increasing retail-targeted attacks; a VikingCloud survey earlier this year found 80% of retailers had experienced a cyberattack in the previous 12 months, with over half reporting heightened vulnerability.