Exposed Hacker Server Reveals Large-Scale Gift Card Fraud Operation and Additional Schemes

Exposed Server Documents Gift Card Fraud at Scale

Cybernews researchers discovered an exposed threat actor server in late July 2026 containing source code, attack notes, databases, and results tied to a large-scale gift card fraud operation. The team believes the program ran at least from March 2026.

The attacker focused on intercepting gift cards uploaded to peer-to-peer trading platforms, capturing valuable card data before normal transactions completed. Gift cards are lucrative targets because they function like digital cash, can be redeemed quickly, resold easily, and are difficult to recover once stolen.

How the Operation Worked

Threat actors conducted reconnaissance against dozens of online platforms. The server's owners identified 58 gift card trading platforms and 3 P2P crypto exchange platforms accepting gift cards as payment. The main revenue stream came from intercepting newly uploaded gift cards using 10 Python scripts across 10 platforms, monitoring fresh uploads within a 90-second window.

The attacker exploited publicly exposed storage buckets and misconfigurations allowing authentication bypass or access to gift card data. The server stored 4,098 order records, 3,690 image hashes, and 3,998 captured gift card images linked to Cardlumi. One platform, Cardtonic, had an API misconfiguration allowing any authenticated user to request trade information including plaintext gift card codes and user emails, though this was only tested at proof-of-concept level.

Additional Operations Revealed

The server also contained material targeting Trustonic ALPS, a cloud platform used by mobile operators to remotely lock or unlock devices. The attacker combined compromised credentials with an API misconfiguration allowing read-only users to change device lock policies. Trustonic stated its internal investigation found credentials were compromised through infostealer malware on affected customers' endpoints, not through a breach of its platform. The company reset passwords for impacted accounts.

A second operation involved Octoplus Box, a mobile phone servicing tool. The attacker set up a fake GSM service resembling the Dhru Fusion API and used 10 compromised accounts to sell services through a Telegram bot. The server stored a SQLite database with compromised reseller account data, including usernames, plaintext passwords, and 341 transaction records.

AI-Assisted Workflow

Researchers say the gift card fraud operation was at least partially AI-assisted, with Anthropic's Claude used as the main AI agent in the attack workflow. Files contained references to personal email addresses possibly belonging to the attacker, and reports written in Spanish suggest the operator was Spanish-speaking.

Disclosure timeline: leak discovered July 19, 2026; initial disclosure to Cardtonic and Trustonic August 28, 2026; initial disclosure to Cardlumi August 31, 2026; leak observed closed August 14, 2026.

Sources: Cybernews