Careless hacker leaves gift card fraud blueprint open: What did we learn?

Despite relying on cybercrime to make a living, hackers are not immune to mistakes. Our team discovered an exposed server with documented large-scale fraud operation, centered on online gift card trading platforms.

In late July, our team discovered an exposed threat actor server, which contained source code, attack notes, databases, and results tied to illicit activity. The team believes the program ran at least from March 2026.

The attacker appears to have focused on intercepting gift cards uploaded to peer-to-peer (P2P) trading platforms, allowing them to capture valuable card data before the normal transaction process was completed.

Gift cards are a lucrative target for cybercrooks because they function much like digital cash: they can be redeemed quickly, resold easily, and are often difficult to recover once stolen.

The server also contained documentation and results tied to two other attacks, suggesting that the servers’ owner was running several profit-driven schemes at once rather than a single isolated campaign.

Our research team reached out to the affected organizations. We have also reached out to impacted companies for comment and will update the article once we receive a reply.

How did the gift card operation work?

The attacker appears to have spent significant time developing the operation. First, our researchers believe, threat actors carried out reconnaissance against dozens of online platforms that allowed users to buy, sell, or trade gift cards.

The server’s owners likely chose from 58 gift card trading platforms and 3 P2P crypto exchange platforms that also accepted gift cards as a payment method. Exposed data suggest that some platforms were not viable for abuse, while others exposed internal data, gift card references, or infrastructure details that could be useful for follow-on attacks.

Attackers’ main revenue stream likely came from intercepting newly uploaded gift cards. Our team found 10 Python scripts tied to 10 different platforms, allegedly designed to monitor fresh uploads, often within a 90-second window.

Which weaknesses the attacker exploited varied from platform to platform. However, the exposed data indicates that the threat actor focused on publicly exposed storage buckets and misconfigurations that could allow authentication bypass or access to gift card-related data.

Data on the attackers server stored SQLite databases, image hashes, event logs, and captured image references from 10 different gift card trading platforms. The attacker appears to have built a system for harvesting gift card information at scale and turning it into profit.

For example, the exposed server allegedly contained 4,098 order records, 3,690 image hashes, and 3,998 captured gift card images linked to Cardlumi, suggesting that the platform was among the most targeted by the servers’ owner.

One platform, Cardtonic, stood out as the records suggest an API misconfiguration allowed any authenticated user to request information on any trade, including plaintext gift card codes and user email addresses.

However, exposed data shows that this was only tested at proof-of-concept (PoC) level, and no large dump of stolen codes or user information was found on the server.

Numerous illicit operations revealed

The exposed system contained more than just gift card fraud data. According to the researchers, the server also included material linked to two additional operations.

One of them targeted Trustonic ALPS, a cloud-based platform used by mobile operators to remotely lock or unlock devices in cases such as theft or loss.

The attacker combined compromised credentials with an API misconfiguration that allegedly allowed read-only users to change device lock and unlock policies.

The results on the server included compromised tenant and employee credentials, identified weaknesses, and PoC material. However, the exposed dataset did not reveal evidence of mass exploitation.

Meanwhile, the company told Cybernews that an internal investigation revealed that “the credentials discovered on infrastructure controlled by a threat actor were not exposed as a result of a security breach of the Trustonic Telecom Platform.”

The investigation determined that the credentials were compromised through malware infections on the affected customers' endpoints. Specifically, an infostealer malware variant captured users' login credentials directly from their devices' browsers during the authentication process,

Trustonic explained.

Trustonic said it contacted all affected users and recommended immediate malware detention and removal. Additionally, the company resetted passwords for impacted accounts to prevent potential misuse of compromised credentials.

The second operation involved Octoplus Box, a mobile phone servicing tool. According to the exposed information, the attacker set up a fake GSM service resembling the Dhru Fusion API and used 10 compromised Octoplus Box accounts to sell services through a Telegram bot at inflated prices.

Researchers say the server stored a SQLite database containing compromised reseller account data, including usernames, plaintext passwords, and 341 transaction records tied to that scheme.

Details our team uncovered also suggests the gift card fraud operation was at least partially AI-assisted. According to the research summary, Anthropic’s Claude was used as the main AI agent in the attack workflow.

The files further contained references to personal email addresses that may belong to the attacker, while reports written in Spanish may indicate the operator was Spanish-speaking.

Disclosure timeline:

• Leak discovered: July 19th, 2026
• Initial disclosure to Cardtonic and Trustonic: August 28th, 2026
• Initial disclosure to Cardlumi: August 31st, 2026
• Leak observed closed: August 14th, 2026