Moroccan cybercrime group Atlas Lion hiding in plain sight during attacks on retailers

Researchers observed Atlas Lion using phishing to harvest credentials and MFA codes, enrolling attacker-controlled Azure VMs into corporate domains to appear as legitimate devices, and then abusing access to obtain internal documentation and issue fraudulent gift cards; the technique leverages cloud infrastructure and MFA enrollment flows to bypass device protections, though defenders detected the activity due to compliance software and a flagged malicious IP.