In a campaign reported in May 2024, the threat group Storm-0539 targeted retailer employees and gift-card issuance systems—not only shoppers. The attackers sought access to employer accounts, moved through cloud and identity systems, and aimed to reach gift-card portals where compromised accounts could be used to create cards for illicit cash-out or resale. This is a retailer-side form of gift card fraud; it does not mean consumer-facing scams have disappeared.
How the retailer-focused gift card scam works
Storm-0539, also known as Atlas Lion, uses employee access as a route toward the systems that issue gift cards. Microsoft describes the group’s approach as cloud and identity reconnaissance, session and token compromise, and persistent access. The steps below summarize the pathway reported by Microsoft and Dark Reading; they do not establish that every attack follows an identical sequence.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
One4all Physical Gift Card | $50.00 | Buy on Amazon |
| 2 |
|
Visa Physical Gift Card $200 (plus $6.95 Purchase Fee) | $206.95 | Buy on Amazon |
| 3 |
|
Visa Physical Gift Card $100 (plus $5.95 Purchase Fee) | $105.95 | Buy on Amazon |
| 4 |
|
TJX Multibrand Physical Gift Card | $50.00 | Buy on Amazon |
| 5 |
|
Visa Physical Gift Card $50 (plus $4.95 Purchase Fee) | $54.95 | Buy on Amazon |
- Target employees. Phishing texts seek to compromise retail workers’ employer accounts.
- Explore cloud and identity resources. With access, attackers investigate the retailer’s environment and move through services. Microsoft says the group can use a compromised session and token, then register malicious devices to maintain access and receive secondary authentication prompts.
- Find a route to sensitive systems. Information or access involving services such as SharePoint or VPNs may help attackers reach gift-card infrastructure, according to Microsoft analyst Emiel Haeghebaert as quoted by Dark Reading.
- Abuse the issuance process. If attackers reach a gift-card portal, compromised accounts can be used to create cards for illicit use. Cards may be cashed out directly, moved through money mules, or sold to other malicious actors.
Haeghebaert, Senior Hunt Analyst at the Microsoft Threat Intelligence Center, said in Dark Reading’s May 23, 2024 report: “Storm-0539 gathers information on a wide variety of resources in targeted environments to advance toward its objective to steal gift cards.”
How this differs from scams aimed at gift-card buyers
In a familiar consumer scam, a fraudster persuades a shopper to buy a gift card and share its code. This reported campaign instead focuses on retailer employees, identity access, and the systems that issue cards. The distinction matters: a buyer may not be the point of compromise when a retailer’s issuance process is targeted. The retailer-side method is not evidence that buyer-focused scams have stopped.
#1 Best Overall
- Sometimes a shopping spree is just the thing to make their day!
- Give a gift they can spend on a new outfit, something for home, or a little extra self-care.
- Exchange this RETAIL THERAPY One4all Favorites Gift Card at redeem.giftcards.com for a choice of eGift(s) to spend at one or more of these brands: Gap, Macy’s, Nordstrom, Panera Bread, The Cheesecake Factory, Ulta Beauty, Wayfair.
- Redemption: Online exchange required before use. Visit redeem.giftcards.com and enter card details to select the eGift(s) you want from the participating brands.
- No Returns or Refunds on gift cards.
What the reported activity figures mean
Microsoft reported a 30% increase in Storm-0539 activity between March and May 2024. Dark Reading also reported that Microsoft measured activity from September to December 2023 as 60% higher than usual. These are historical figures tied to those stated periods—not estimates of the group’s activity in 2026.
How retailers can reduce exposure
Microsoft recommends treating gift-card portals as high-value targets, monitoring them continuously, and auditing anomalous activity. It also recommends layered identity and cloud-security controls. No single control is described as preventing every attack.
Rank #2
- Gift Cards are shipped active and ready for use.
- This card is non-reloadable. No cash or ATM access. Funds do not expire. If available funds remain on your card after the valid thru date has passed, please call customer service for a replacement card. A one-time purchase fee applies at the time of checkout. No fees after purchase.
- To access your card information safely, type the complete website address shown on your Gift Card (MyGift.GiftCardMall.com) directly into your browser's address bar. Don't use search engines or shortened versions of the website address, as these may lead you to fake or fraudulent sites. Do not provide any Gift Card details (example: Card Number) to someone you do not know or trust. If you believe you've reached an illegitimate website, contact cardholder service at 1-888-524-1283. Be cautious of phishing sites, there are a variety of scams in which fraudsters try to trick others into paying with gift cards.
- To report your Lost or Stolen Physical Visa Card, call Customer Service 24/7 at 1 (888) 524-1283 to cancel your Gift Card as soon as you can. You will be asked to provide the Gift Card number and other identifying information.
- Use your Visa Gift Card in the U.S. everywhere Visa debit cards are accepted, including online.
- Strengthen sign-in protections. Use conditional access and sign-in risk policies, and implement phishing-resistant multifactor authentication (MFA). A physical FIDO2 security key can be one implementation option, but organizations should confirm compatibility with their identity system.
- Limit access. Apply least privilege so employees and service accounts have only the access their roles require.
- Monitor issuance activity. Watch gift-card portals for unusual activity and audit anomalies promptly.
- Protect accounts and sessions. Microsoft’s guidance, as summarized by Dark Reading, includes strict password-reset measures and protections against token replay and other fraud.
- Improve organizational readiness. Apply cloud-security practices and educate security teams about social engineering so suspicious activity can be recognized and escalated.
For a retailer, the practical priorities are to secure the identities that can reach issuance systems, restrict who can create cards, and make unusual issuance visible quickly. These measures address different parts of the attack path rather than relying on a single barrier.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is—and is not—established
The May 23, 2024 reporting does not identify named retailer victims, confirmed total losses, or counts of fraudulent cards. It also does not establish a current 2026 activity level. Microsoft’s description of session and token use followed by malicious device registration and secondary authentication prompts does not support a claim that Storm-0539 bypasses every form of MFA.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Best Value
- Gift Cards are shipped active and ready for use.
- This card is non-reloadable. No cash or ATM access. Funds do not expire. If available funds remain on your card after the valid thru date has passed, please call customer service for a replacement card. A one-time purchase fee applies at the time of checkout. No fees after purchase.
- To access your card information safely, type the complete website address shown on your Gift Card (MyGift.GiftCardMall.com) directly into your browser's address bar. Don't use search engines or shortened versions of the website address, as these may lead you to fake or fraudulent sites. Do not provide any Gift Card details (example: Card Number) to someone you do not know or trust. If you believe you've reached an illegitimate website, contact cardholder service at 1-888-524-1283. Be cautious of phishing sites, there are a variety of scams in which fraudsters try to trick others into paying with gift cards.
- To report your Lost or Stolen Physical Visa Card, call Customer Service 24/7 at 1 (888) 524-1283 to cancel your Gift Card as soon as you can. You will be asked to provide the Gift Card number and other identifying information.
- Use your Visa Gift Card in the U.S. everywhere Visa debit cards are accepted, including online.
Rank #4
- One gift card, five incredible brands. A TJX gift card is perfect for celebrating birthdays, holidays, a new home or just because.
- Score amazing savings on designer fashions for you, top-brand finds for your home, and everything you need for your outdoor adventures.
- With thousands of new arrivals across all five brands every week, the selection is ever-changing.
- The TJX gift card is redeemable at all HomeGoods, TJ Maxx, Marshalls, Sierra, and Homesense stores (in the U.S. and Puerto Rico) and online at TJ Maxx, Marshalls, and Sierra.
- Physical gift cards are delivered active via mail.
Rank #3
- Gift Cards are shipped active and ready for use.
- This card is non-reloadable. No cash or ATM access. Funds do not expire. If available funds remain on your card after the valid thru date has passed, please call customer service for a replacement card. A one-time purchase fee applies at the time of checkout. No fees after purchase.
- To access your card information safely, type the complete website address shown on your Gift Card (MyGift.GiftCardMall.com) directly into your browser's address bar. Don't use search engines or shortened versions of the website address, as these may lead you to fake or fraudulent sites. Do not provide any Gift Card details (example: Card Number) to someone you do not know or trust. If you believe you've reached an illegitimate website, contact cardholder service at 1-888-524-1283. Be cautious of phishing sites, there are a variety of scams in which fraudsters try to trick others into paying with gift cards.
- To report your Lost or Stolen Physical Visa Card, call Customer Service 24/7 at 1 (888) 524-1283 to cancel your Gift Card as soon as you can. You will be asked to provide the Gift Card number and other identifying information.
- Use your Visa Gift Card in the U.S. everywhere Visa debit cards are accepted, including online.
Sources
- Dark Reading, Nate Nelson, “New Gift Card Scam Targets Retailers, Not Buyers, to Print Endless $$$,” May 23, 2024.
- Microsoft Security Blog, Vasu Jakkal, “Cyber Signals: Inside the growing risk of gift card fraud,” May 23, 2024.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
