New Gift Card Scam Targets Retailers, Not Buyers, to Print Endless $$$

Storm-0539 (Atlas Lion) is running a targeted campaign against retailers: attackers phish employees to gain access to internal systems and gift-card portals, perform cloud reconnaissance and lateral movement to escalate privileges, then mass-create gift cards for cash-out. Microsoft notes the group’s high level of cloud and reconnaissance skill, seasonal increases in activity, and recommends phishing-resistant MFA, strict password resets, fraud protections, and least-privilege controls.