Moroccan Cybercrime Group Steals Up to $100K Daily Through Gift Card Fraud

Microsoft and the FBI warn of Storm-0539 (also known as Atlas Lion), a Morocco-based financially motivated criminal group using advanced phishing (including AitM and smishing) and cloud abuse to steal gift card credentials and session tokens from large retailers and other brands. The actors bypass MFA by registering their own devices, leverage compromised internal email lists and ephemeral cloud sites to improve legitimacy, perform reconnaissance in cloud environments, and monetize stolen gift cards and credentials on black markets; observed activity and impact have increased in 2024.