A cybercriminal group operating out of Morocco is targeting major retailers, infiltrating their systems to steal millions by creating fraudulent gift cards for themselves, according to a new report by Microsoft.
This isn’t your typical gift card scam targeting unsuspecting shoppers. The group, dubbed “Atlas Lion” or “Storm-0539,” bypasses consumers entirely, focusing on compromising the internal systems of large retailers, luxury brands, and even fast-food chains.
“Storm-0539 infiltrates large retailers and fraudulently issues gift card codes to themselves, virtually printing their own money,” said Vasu Jakkal of Microsoft.
Unlike most cybercriminals who launch a single attack and move on, Storm-0539 establishes a persistent presence within a compromised system, allowing them to repeatedly generate and cash out fraudulent gift cards.
This tactic makes them especially dangerous, with Microsoft reporting a troubling 30% increase in their activity leading up to the Memorial Day holiday compared to the previous two months.
Gift cards have always been a tempting target for cybercriminals because they’re not typically linked to specific accounts, making them harder to trace. Storm-0539, however, has taken it a step further.
Microsoft has been tracking the group since late 2021. Initially, they focused on stealing payment card data directly from point-of-sale systems.
However, they’ve since adapted, shifting their focus towards compromising cloud services and card systems used by major retailers.
The group employs a multi-step approach. First, they meticulously study an organization’s gift card issuance process and employee access protocols.
To avoid detection, they create fake identities posing as legitimate non-profit organizations. This allows them to exploit discounts offered by cloud service providers. They even go so far as to create fake websites with domain names that closely resemble real charities (a tactic known as typosquatting) to further their deception.
Using stolen tax documents from real non-profits, they trick employees into giving away login credentials through phishing emails and text messages (smishing).
Once inside, they register their own devices on the victim network, bypassing multi-factor authentication (MFA) and maintaining persistent access.
With full control, they create new gift cards and cash them out through various methods. This includes recruiting “money mules” to redeem the cards or selling them at a discount on the dark web to other criminals.
Researchers at Microsoft have observed instances where Storm-0539 has stolen as much as $100,000 a day from a single company using this method.
Microsoft is urging businesses that issue gift cards to tighten security around their card issuance systems. These portals should be treated as high-value targets, requiring rigorous controls before new cards are created.
This warning comes just months after a similar alert issued by Microsoft in December, highlighting a surge in Storm-0539 activity during the holiday season. With the holiday season approaching again, retailers and consumers alike should be aware of this evolving threat.
