A new report sheds light on Atlas Lion, also known as Storm-0539, a Morocco-based cybercriminal operation that has developed a niche in infiltrating large retailers’ systems to fraudulently issue gift card codes for themselves, utilizing advanced phishing techniques. This method allows them to “print their own money” by remaining in the compromised systems for repeated thefts, diverging from the more common direct scams or phishing attacks for gift card-based payments. The appeal of gift cards to cybercriminals lies in their anonymity and the reduced likelihood of scrutiny, with such scams typically spiking during holiday seasons. Microsoft noted a significant uptick in Storm-0539’s activity in the run-up to the Memorial Day holiday, indicating a strategic timing for their operations. Over the years, Storm-0539 has shifted its focus from malware attacks on point-of-sale devices to exploiting cloud services and card systems, targeting prominent retailers and well-known brands. Their tactics include conducting thorough reconnaissance, using phishing and smishing to compromise accounts, and adopting legitimate organization guises to access resources from cloud providers. Their sophisticated approach includes creating misleading websites and obtaining legitimate nonprofit documentation to exploit cloud service discounts. Once inside a network, they bypass multi-factor authentication, create new gift cards, and monetize them through various illicit means, with daily thefts reaching up to $100,000 in some instances. Organizations issuing gift cards are advised to treat their card issuing portals as high-value targets that require robust security measures. It’s also suggested that multi-factor authentication be complemented with additional access policy conditions that also authenticate requests based on IP address geo-location and device status.