Observing Atlas Lion (part one): Why take control when you can enroll?

Atlas Lion, a Morocco-based cybercrime group targeting gift-card issuers, used SMS phishing to capture credentials and session cookies, registered their own MFA device, and enrolled attacker-controlled Azure VMs into a victim's Entra ID so the VMs appeared as legitimate corporate devices; the attack was detected when Defender flagged a known-malicious IP during automated endpoint onboarding and was remediated.