Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign

According to Unit 42, the Jingle Thief campaign is led by financially motivated Morocco-based attackers who have operated since 2021 and focus on global retailers’ gift-card issuance systems. The activity is tracked as cluster CL‑CRI‑1032, with overlaps to threat actors publicly tracked as Atlas Lion, and the campaign largely relies on cloud-based identity misuse rather than malware.

In the observed operations, threat actors maintained access for approximately 10 months and compromised over 60 user accounts within a single global enterprise, employing Microsoft 365 services to map environments, conduct reconnaissance and issue high‑value cards. They use tailored phishing and smishing to harvest credentials, then move laterally via internal phishing and inbox monitoring to monetise fraud at scale.

In April and May 2025, the group launched a wave of coordinated attacks across multiple global enterprises, highlighting their emphasis on long‑term footholds and stealthy credential‑based access within cloud environments.