The calendar does the attackers a favor every year. Retail transaction volume peaks between Black Friday and the end of December, seasonal staff arrive with new accounts and little training, and the security team’s own coverage thins out around Thanksgiving, Christmas, and New Year’s Day. Defenders have the most to protect at the moment they have the fewest people watching.

This piece is about closing that gap deliberately: which activity is worth detecting, why gift-card systems deserve their own attention, and how to build an escalation rota that still works when half the team is away.

What the season changes for attackers

Fraud incentives and defender attention move in opposite directions. Holiday-themed phishing and fake storefronts surge because buyers are rushing and expecting deliveries, shipping notices, and promotions. Fortinet’s 2025 holiday analysis, as summarized in secondary coverage, counted more than 18,000 newly registered holiday-themed domains, of which roughly 750 (about 4%) were classified as malicious. Vendor numbers like these use different methodologies and are indicative, not definitive, but the direction matches what retail defenders report: lookalike domains and delivery lures spike before the peak, not during it.

Staff turnover compounds the exposure. A 2024 VikingCloud holiday survey, reported by Chain Store Age, found 52% of retailers saying the final months of the year are when they face their highest risk, with limited internal IT resources named as the top challenge. The survey’s coverage elsewhere cites low rates of social-engineering training for seasonal workers, but the primary page we could retrieve did not include those percentages, so we do not rely on them here.

Gift cards are an identity problem, not a payments problem

The most instructive recent case is the campaign Palo Alto Networks’ Unit 42 published in October 2025 as “Jingle Thief,” tracked as cluster CL-CRI-1032 and assessed with moderate confidence to overlap with the groups known as Atlas Lion and STORM-0539. It targeted gift card issuance systems at global retail and consumer-services companies, and the interesting part is how little malware it used.

Per Unit 42’s report, the attackers phished or smished employee credentials, signed in to Microsoft 365, and then searched SharePoint and OneDrive for the documents describing how gift cards are issued and tracked. In one investigated case they kept access for about ten months and compromised more than 60 user accounts at a single global enterprise. To hold that access they registered rogue authenticator apps, reset passwords through self-service flows, and enrolled attacker-controlled devices in Microsoft Entra ID, which preserved access after password resets or session revocations.

The lesson for a SOC is that the monetization step, issuing high-value cards, happens inside a legitimate business application, with a legitimate employee identity. Perimeter and endpoint alerts will not fire. Identity telemetry will.

Detections worth tuning before November

Unit 42’s own list of alerts that caught this activity is a good template, because each maps to something an analyst can check:

  • Inbox rules that forward mail externally, or that move sent messages to Deleted Items. Attackers used both to hide their own phishing from the account owner.
  • First-time sign-ins: a new country, a new ASN for the user or the organization, a new operating system, or a first-ever VPN connection from an unfamiliar country.
  • Impossible-travel and risky-sign-in alerts from your identity provider.
  • Bulk downloads from SaaS file stores, especially from accounts in gift card, loyalty, or finance roles.

To these, add three seasonal items of our own: new authenticator-method registrations and new device enrollments on accounts that already exist (the persistence mechanism above); self-service password resets followed by activity from a new location; and any change to gift card issuance limits or the list of users permitted to issue cards. Alert on the change, not just the use.

Pair detection with a pre-holiday control review: restrict gift card issuance to named roles, require step-up authentication for issuance, and set daily value caps that force a human check on outliers. Those are cheap to implement and directly interrupt the fraud’s cash-out step.

Building an escalation rota that survives the holidays

CISA and the FBI issued a joint warning on holiday and weekend ransomware timing in 2021, noting that the guidance rested on the timing of past high-impact attacks, not on specific threat reporting. Their practical recommendation then still holds: identify security staff who are available and on call during holidays and weekends. A rota that exists only as an intention does not meet that bar. A workable version has a few features.

Name people, not teams

“Security on-call” fails at 2 a.m. on December 26 if no one knows who that is. Publish a named primary and a named secondary for every holiday date, with phone numbers that do not depend on corporate email being up.

Pre-authorize containment actions

The most expensive holiday delay is waiting for a manager to approve disabling an account or isolating a host. Write down, in advance, which containment actions the on-call analyst may take unilaterally: revoking sessions for a compromised user, disabling an account, blocking a sender domain, isolating an endpoint in a defined list of systems. Make revocation of all refresh tokens and removal of rogue authenticators part of that playbook, since the case above shows password resets alone do not evict an attacker.

Define the call-out threshold in writing

Decide which alert classes wake someone up and which wait until the morning, and write the list. For a retail environment, reasonable page-worthy classes include a gift card issuance anomaly, an admin-role sign-in from a new country, mass mailbox-rule creation, and payment-system outages that coincide with suspicious access.

Rehearse once

A tabletop in early November that walks a fake gift card fraud alert from detection through a Sunday escalation will expose the missing phone number, the expired VPN token, and the approval nobody remembered to delegate.

The takeaway

Nothing in the seasonal playbook is exotic. The work is to move decisions earlier: tune identity detections before the volume arrives, restrict what a stolen account can do with gift cards, and settle who can contain an incident without asking permission. If the first time you discover who is on call is the first time you need them, the holiday will have already chosen the date for your incident.