Cybersecurity researchers have make clear a cybercriminal group known as Jingle Thief that has been noticed concentrating on cloud environments related to organizations within the retail and client providers sectors for reward card fraud.
“Jingle Thief attackers use phishing and smishing to steal credentials, to compromise organizations that subject reward playing cards,” Palo Alto Networks Unit 42 researchers Stav Setty and Shachar Roitman said in a Wednesday evaluation. “As soon as they achieve entry to a corporation, they pursue the kind and degree of entry wanted to subject unauthorized reward playing cards.”
The top objective of those efforts is to leverage the issued reward playing cards for financial achieve by possible reselling them on grey markets. Present playing cards make for a profitable alternative as they are often simply redeemed with minimal private info and are tough to hint, making it tougher for defenders to analyze the fraud.
The title Jingle Thief is a nod to the menace actor’s sample of conducting reward card fraud coinciding with festive seasons and vacation durations. The cybersecurity firm is monitoring the exercise beneath the moniker CL‑CRI‑1032, the place “CL” stands for cluster and “CRI” refers to felony motivation.
The menace cluster has been attributed with average confidence to felony teams tracked as Atlas Lion and Storm-0539, with Microsoft describing it as a financially motivated crew originating from Morocco. It is believed to be energetic since a minimum of late 2021.
Jingle Thief’s skill to keep up footholds inside compromised organizations for prolonged durations, in some circumstances for over a 12 months, makes it a harmful group. Through the time it spends with the environments, the menace actor conducts in depth reconnaissance to map the cloud atmosphere, strikes laterally throughout the cloud, and takes steps to sidestep detection.
Unit 42 mentioned it noticed the hacking group launching a wave of coordinated assaults concentrating on varied world enterprises in April and Might 2025, utilizing phishing assaults to acquire credentials essential to breach victims’ cloud infrastructure. In a single marketing campaign, the attackers are mentioned to have maintained entry for about 10 months and damaged into 60 person accounts inside a single group.
“They exploit cloud-based infrastructure to impersonate reliable customers, achieve unauthorized entry to delicate knowledge, and perform reward card fraud at scale,” the researchers famous.
The assaults typically contain makes an attempt to entry reward‑card issuance purposes to subject excessive‑worth playing cards throughout completely different applications, whereas concurrently guaranteeing these actions depart minimal logs and forensic trails.
 |
| Jingle Thief phishing assault chain throughout Microsoft 365 |
They’re additionally extremely focused and tailor-made to every sufferer, with the menace actors finishing up reconnaissance earlier than sending persuasive phishing login pages through electronic mail or SMS that may idiot victims and trick them into getting into their Microsoft 365 credentials.
As quickly because the credentials are harvested, the attackers waste no time logging into the atmosphere and perform a second spherical of reconnaissance, this time concentrating on the sufferer’s SharePoint and OneDrive for info associated to enterprise operations, monetary processes, and IT workflows.
This consists of trying to find reward card issuance workflows, VPN configurations and entry guides, spreadsheets or inside methods used to subject or monitor reward playing cards, and different key particulars associated to digital machines and Citrix environments.
Within the subsequent part, the menace actors have been discovered to leverage the compromised account to ship phishing emails internally throughout the group to broaden their foothold. These messages typically mimic IT service notifications or ticketing updates by making use of knowledge gleaned from inside documentation or earlier communications.
Moreover, Jingle Thief is understood to create inbox guidelines to mechanically ahead emails from hacked accounts to addresses beneath their management, after which cowl up traces of the exercise by shifting the despatched emails instantly to Deleted Objects.
In some circumstances, the menace actor has additionally been noticed registering rogue authenticator apps to bypass multi-factor authentication (MFA) protections and even enrolling their units in Entra ID in order to keep up entry even after victims’ passwords are reset or the session tokens are revoked.
Apart from their unique give attention to cloud providers moderately than endpoint compromise, one other side that makes Jingle Thief’s campaigns noteworthy is their propensity for identification misuse over deploying customized malware, thereby minimizing the possibilities of detection.
“Present card fraud combines stealth, pace and scalability, particularly when paired with entry to cloud environments the place issuance workflows reside,” Unit 42 mentioned. “This discreet method helps evade detection whereas laying the groundwork for future fraud.”
“To take advantage of these methods, the menace actors want entry to inside documentation and communications. They will safe this by stealing credentials and sustaining a quiet, persistent presence inside Microsoft 365 environments of focused organizations that present reward card providers.”
