Jingle Thief Attackers Exploiting Festive Season with Weaponized Gift Card Attacks

As the festive season approaches, organizations are witnessing a disturbing increase in targeted attacks on digital gift card systems.

The Jingle Thief campaign, orchestrated by financially motivated threat actors based in Morocco, has emerged as a notorious campaign exploiting seasonal vulnerabilities to steal and monetize gift cards at scale.

By leveraging tailored phishing and smishing campaigns, the attackers set their sights on major retailers and large enterprises operating cloud-based infrastructures, particularly those reliant on Microsoft 365 and similar services.

Their goal: compromise user credentials, gain unauthorized access, and exploit gift card systems during periods of heightened activity and reduced vigilance.

The operation begins with carefully crafted phishing emails and SMS messages that entice victims into providing their login details via deceptive portals mimicking legitimate Microsoft 365 interfaces.

These counterfeit sites, uniquely branded to mirror the targeted organization’s style, harvest credentials while evading routine detection.

Attackers often send out these lures using self-hosted PHP mailer scripts running from compromised WordPress servers, effectively obscuring their own infrastructure.

Once inside, they proceed with extensive reconnaissance , pivoting laterally through SharePoint and OneDrive accounts to locate internal documentation and gift card issuance workflows.

Their sophistication lies not merely in the initial compromise but in their ability to remain undetected—sometimes for months—while orchestrating repeated fraud attempts across multiple gift card issuance applications.

Palo Alto Networks analysts tracked the Jingle Thief campaign under cluster CLCRI1032, linking it to known threat entities such as Atlas Lion and STORM-0539.

Their research uncovered advanced operational tactics focused on maintaining persistence and operational patience.

Attacks observed in early 2025 saw over 60 user accounts compromised within a single global organization, with threat actors demonstrating adaptable methods to subvert defensive controls, including mailbox manipulation and identity infrastructure abuse.

Jingle Thief phishing attack chain across Microsoft 365 (Source – Palo Alto Networks) The attack lifecycle showcases how initial access via phishing evolves toward long-term persistence through rogue device registration.

Infection Mechanism: Persistence through Device Registration

A striking element of the Jingle Thief campaign is its method of establishing persistent, malware-resistant access.

After credential theft, threat actors exploit Microsoft Entra ID’s self-service and device enrollment features, registering attacker-controlled devices and rogue authenticator apps.

This approach subverts multi-factor authentication (MFA), allowing them continuous access—even after password resets.

The attackers have been observed silently enrolling smartphones using the native onboarding process:-

Example: Rogue Device Enrollment – Simulated Python workflow

import requests url = " data = requests.post(url, json=data) Device registration flow in Microsoft Entra ID (Source – Palo Alto Networks) This illustrating how the adversary leverages legitimate MFA onboarding to entrench in the environment, making detection extremely challenging.

Through these advanced techniques, Jingle Thief attackers reliably evade conventional security controls, rendering typical remediation measures ineffective until full identification and infrastructure clean-up are achieved.

Cybersecurity teams are urged to prioritize identity-based monitoring and behavioral anomaly detection, especially during festive seasons when such threats intensify.

Follow us on  Google News ,  LinkedIn , and  X  to Get More Instant Updates ,  Set CSN as a Preferred Source in  Google .

Based on reporting by Cyber Security News.