Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign

Jingle Thief is a Unit 42 investigation into a financially motivated Morocco-based campaign that uses targeted phishing and smishing to harvest Microsoft 365 credentials, perform extensive cloud reconnaissance of SharePoint/OneDrive, and maintain long-term persistence (including rogue device/enrolment and mailbox rules) to issue and monetise high-value gift cards; the report includes IoCs (multiple Moroccan IPs, ASNs, phishing URL patterns), MITRE mappings, and recommended detections and mitigations using Cortex XDR/UEBA/ITDR.