Atlas Lion phishing campaign (Campaign)

Microsoft has identified a Morocco-based cybercrime group known as Storm-0539 (Atlas Lion) conducting a coordinated phishing campaign since 2021 that targets large retailers' gift card services. The group abuses advanced techniques—adversary-in-the-middle phishing, smishing, MFA bypass, and cloud infrastructure exploitation—to steal and sell gift cards; Microsoft observed a ~30% increase in these attacks between March and May 2024, and linked guidance and reports are provided (IC3, Microsoft).