Jingle Thief  (Back to overview)

Jingle Thief is a financially motivated gift card fraud campaign documented by Palo Alto Networks Unit 42 in October 2025 and tracked as cluster CL-CRI-1032, assessed with moderate confidence to be run by Morocco-based attackers active since 2021, not affiliated with a nation-state. It targets cloud environments of large retail and consumer services organizations: phishing and smishing harvest Microsoft 365 credentials, then the actors, without malware, perform SharePoint and OneDrive reconnaissance of gift card issuance workflows, send internal phishing from compromised accounts, set forwarding rules, and persist by registering rogue authenticator apps and enrolling devices in Entra ID; in one case access lasted about 10 months across more than 60 accounts. Unit 42 assesses with moderate confidence that CL-CRI-1032 overlaps with the actors publicly tracked as Atlas Lion and Storm-0539; it is kept as a separate entry and linked to Storm-0539 as similar. In October 2026, 404 Media reported an organized crime gang that hacked Staples and issued millions of dollars in gift cards; The Hacker News related this to Jingle Thief, but the reporting does not attribute that intrusion to the cluster.

Associated Families

There are currently no families associated with this actor.

References