Jingle Thief

Jingle Thief is a financially motivated cybercrime group tracked by Palo Alto Networks Unit 42 as cluster CL-CRI-1032. Unit 42 assesses with moderate confidence that the activity overlaps with actors publicly tracked as Atlas Lion and STORM-0539, and attributes the campaign with moderate confidence to Morocco-based attackers active since 2021. The group primarily targets global retailers and consumer services organizations, especially those that rely heavily on cloud-based infrastructure and issue gift cards, with activity noted to increase during holiday periods. The group’s objective is unauthorized issuance of high-value gift cards for resale on gray markets, with reporting stating the fraud has stolen hundreds of thousands of dollars. Jingle Thief operates largely inside Microsoft 365 and related cloud services rather than relying on traditional endpoint malware. Reported tradecraft includes tailored phishing and smishing to steal Microsoft 365 credentials; cloud reconnaissance in SharePoint and OneDrive to identify gift card issuance workflows, ticketing systems, VPN configuration guides, and related internal documentation; and internal phishing from compromised Microsoft 365 accounts, including fake ServiceNow alerts and IT access notifications, to obtain additional or higher-privileged credentials. For persistence and stealth, the actors abuse legitimate Microsoft Entra ID self-service and device-enrollment features, including registering rogue authenticator apps, resetting passwords through self-service flows, and enrolling attacker-controlled devices to retain access even after password resets or session revocation. They also create Exchange inbox forwarding rules for passive monitoring, watch communications related to gift card approvals, financial workflows, and IT ticketing, and hide evidence by moving sent phishing emails and victim replies into Deleted Items. Additional reported techniques include deceptive phishing URLs using the "@" symbol to disguise the true destination, delivery of phishing via self-hosted PHP mailer scripts often on compromised or hijacked WordPress servers, and use of infrastructure and IP space geolocated primarily in Morocco, with occasional use of Mysterium VPN. Unit 42 reported long-dwell intrusions, including one case with approximately 10 months of access and more than 60 compromised user accounts within a single global enterprise. Known aliases and related tracking names directly mentioned in the content are CL-CRI-1032, Atlas Lion, and STORM-0539.