Jingle Thief: Unpacking Cloud Fraud and Identity-Driven Attacks

The Jingle Thief Campaign

• 💡 The "Jingle Thief" campaign is a cloud-only, identity-driven operation by the Morocco-based group Atlas Lion.
• 🎯 This campaign exploits Microsoft 365 environments to commit large-scale gift card fraud against global retailers.
• 💰 Attackers monetize compromised accounts by issuing and selling gift cards, which are described as digital cash with no traceability.

Attack Methods and Persistence

• 🎣 Initial access is gained through highly tailored phishing and smishing pages, often using the "URL at sign trick" to deceive users.
• ⏳ Attackers demonstrate extreme patience, remaining active within an organization for over 10 months.
• ⚙️ They abuse legitimate Microsoft 365 identity features like device registration (to bypass MFA) and exchange inbox forwarding rules for ongoing visibility.
• 🕵️ The campaign leverages