Cybersecurity report links global ‘Jingle Thief’ scam to hackers operating from Morocco

A new investigation by Unit 42, the cybersecurity research arm of Palo Alto Networks, has uncovered an international cyber fraud campaign dubbed “Jingle Thief”, allegedly led by hackers operating from Morocco.

The group has been targeting global retail and consumer service companies through phishing emails and text messages to gain access to corporate systems and issue unauthorized digital gift cards during holiday seasons.

According to the report, the attackers’ main objective is financial gain, exploiting gift card platforms that can be easily monetized and resold in unregulated online markets.

Unit 42 said the hackers behind “Jingle Thief” are “particularly dangerous” because of their ability to maintain long-term access to compromised networks,  sometimes for more than a year, allowing them to study internal systems and evade detection.

The coordinated attacks, launched between April and May 2025, reportedly compromised more than 60 user accounts within a single multinational company. The hackers primarily operate in cloud environments, using stolen login credentials rather than traditional malware.

Once inside, they exploit platforms such as Microsoft 365, including SharePoint, OneDrive, Exchange, and Entra ID, to impersonate legitimate users and access sensitive data.

The report noted that the attackers’ operations trace back to Moroccan IP addresses, often without concealing their location. In some instances, they used virtual private networks (VPNs) such as Mysterium, with network signatures linked to Moroccan telecommunications providers.

Gift cards are particularly attractive to cybercriminals, the report said, because they are difficult to trace, easy to cash out or resell, and often issued through systems with weak access controls.

Unit 42 suggested that the stolen cards may also have been used for money laundering or short-term liquidity schemes.

Rather than using malware, the “Jingle Thief” actors rely on internal phishing tactics, sending deceptive messages from already compromised accounts to other employees, mimicking IT service alerts or update notifications.

Unit 42 said this approach allows attackers to expand their access stealthily across entire organizations.

The group, active since 2021, is not believed to be state-sponsored but operates with a high level of sophistication and persistence.

Investigators said their activity typically spikes during major holidays, when retail transactions surge and IT staffing is reduced.