“Jingle Thief” Hackers Exploit Cloud Infrastructure to Steal Millions in Gift Cards

The Jingle Thief group has been observed targeting cloud environments used by retailers and consumer services firms to fraudulently issue gift cards, with phishing and smishing used to steal credentials and access organisational systems. According to Palo Alto Networks Unit 42 researchers Stav Setty and Shachar Roitman, the attackers first gain access to an organisation and then pursue the level of access needed to issue unauthorized gift cards.

The group has been linked with a campaign in April and May 2025, during which they maintained access for about 10 months and breached about 60 user accounts within a single organisation. Unit 42 notes that gift cards are pursued because they can be easily redeemed and are hard to trace, enabling fraud at scale; the attackers exploit cloud-based infrastructure to impersonate legitimate users and access gift-card issuance workflows.

The threat cluster has been attributed with moderate confidence to Atlas Lion and Storm-0539, with Microsoft describing it as a financially motivated crew originating from Morocco, active since at least late 2021.