InfoSecBulletin Cybersecurity for mankind
A large Azure data theft campaign is surfacing on the dark web. A hacker is offering employee lists taken from big companies around the world. The seller, operating under the alias “TheHatman,” claims to have pulled these records directly from victim organizations’ Azure and Entra tenants using compromised credentials, and the volume of data on offer is staggering.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
TheHatman has filled underground forums this past week with listings for at least nine big companies in IT services, hotels, telecom, retail, and logistics.
According to the claim, McDonald’s Corporation has the most exposed records with over 1.7 million. Tata Consultancy Services comes next with about 800,000 records. Vodafone has around 425,000, and HCL Technologies has about 250,000.
Additional victims are InterContinental Hotels Group with around 185,000 records, Kyndryl with 170,000, Gap Inc. with 80,000, Hexaware Technologies with 20,000, and Wyndham Hotels with 9,000.
Azure Credential Theft Campaign
Hudson Rock researchers who looked at sample data say the information seems very reliable. They mention that the email domains and data formats match typical Azure directory exports exactly.
The leaked data always has the same format. Key parts include full names, work email addresses from company sites and onmicrosoft.com, phone numbers, and addresses. Besides basic contact info, the data also shows details like employee IDs, job titles, departments, managers, and who reports to whom.
Many are worried about the sharing of access and group mapping details, including service account info and sometimes lists of Global Administrator accounts. Revealing this type of sensitive account info gives attackers a clear plan for spear-phishing, social tricks, and raising their privileges.
What is not clear is how the intrusions happened. TheHatman has said many times that the data was taken “using stolen credentials,” but the exact way they got in is still not confirmed, according to Hudson Rock.
Possible reasons are infostealer malware taking session tokens from worker computers, phishing attacks gaining admin-level access, tenants not using strict multi-factor authentication, or misuse of a third-party API with too wide reading permissions. The quick and steady dumps suggest a methodical, probably automated, process once the first access was gained.
Researchers at Hudson Rock found that stolen Azure login information is connected to infostealer attacks on many companies. This includes computers linked to workers at TCS, Gap Inc., HCL Technologies, and Kyndryl.
One hacked device had many corporate logins and a lot of sensitive session cookies, including direct access to a Kyndryl Azure Active Directory account. The presence of only large international companies in this campaign, instead of many smaller ones, suggests that the stolen logins are being targeted rather than a flaw in the Azure platform.
The actual risk is much bigger than just the initial leak. Bad actors often use this kind of structured data to carry out fake business email scams and spear-phishing attacks. They create fake emails that look real by using correct job titles and reporting lines to pretend to be managers or IT workers. This tricks employees into accepting fake money transfers or giving away MFA codes.
The leaking of service account details and admin names serves as a guide for hackers and ransomware groups searching for quick entry into important systems.
Organizations should see this incident as a reminder that keeping credentials safe matters more than just having strong defenses. Regular checks for stolen credentials, using MFA for all tenant portals, and careful review of third-party API permissions are important steps to prevent attacks.
