Unit 42 · Published 22 Oct
Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign
By Stav Setty, Shachar Roitman
Excerpt
Executive Summary
We investigated a campaign waged by financially motivated threat actors operating out of Morocco. We refer to this campaign as Jingle Thief, due to the attackers’ modus operandi of conducting gift card fraud during festive seasons. Jingle Thief attackers use phishing and smishing to steal credentials, to compromise organizations that issue gift cards. Their operations primarily target global enterprises in the retail and consumer services sectors. Once they gain access to an organization, they pursue the type and level of access needed to issue…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Unit 42 on unit42.paloaltonetworks.com.
More from Unit 4219
Unit 42 · Web page · Published 16 Oct
Unit 42 - Latest Cyber Security Research
Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…
Unit 42 · Web page · Published 16 Oct
Unit 42 - Latest Cyber Security Research
Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…
Unit 42 · Web page · Published 16 Oct
Unit 42 - Latest Cyber Security Research
Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…
Unit 42 · Web page · Published 16 Oct
Unit 42 - Latest Cyber Security Research
Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these…
On the same topics
jamf.com · Web page · Added 29 Oct
CloudSyncD: a two-stage macOS backdoor that hides a phished password in zero-width Unicode
Jamf Threat Labs uncovers CloudSyncD, a fake Zoom installer disguised as a legitimate application that uses a phished login password to launch an embedded backdoor while concealing the credential inside a decoy configuration file. September 30 2026 by Jamf…
Team Cymru · Web page · Published 10 Jan
MoqHao Part 1: Identifying Phishing Infrastructure
In mid-January, Twitter users @NaomiSuzuki_ and @KesaGataMe0 identified nearly 20 malicious phishing domains spoofing AEON Bank in Japan. The domains were tied to MoqHao, a malware family targeting Android OS devices, primarily in Japan, South Korea, and…
PRODAFT · Web page · Added 18 Oct
LARVA-208
(EncryptHub) is a threat actor that has come to the forefront with highly sophisticated spear-phishing attacks since 26 June 2024. In the attacks it has carried out, it exhibits a different operational strategy by carrying out all the processes necessary to…
Mandiant (Google) · Web page · Published 14 Sep
Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and Notoriety
UNC3944 is a financially motivated threat cluster that has persistently used phone-based social engineering and SMS phishing campaigns (smishing) to obtain credentials to gain and escalate access to victim organizations. At least some UNC3944 threat actors…