InfoSecBulletin Cybersecurity for mankind
A large Azure data theft campaign is surfacing on the dark web. A hacker is offering employee lists taken from big companies around the world. The seller, operating under the alias “TheHatman,” claims to have pulled these records directly from victim organizations’ Azure and Entra tenants using compromised credentials, and the volume of data on offer is staggering.
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
TheHatman has filled underground forums this past week with listings for at least nine big companies in IT services, hotels, telecom, retail, and logistics.
According to the claim, McDonald’s Corporation has the most exposed records with over 1.7 million. Tata Consultancy Services comes next with about 800,000 records. Vodafone has around 425,000, and HCL Technologies has about 250,000.
Additional victims are InterContinental Hotels Group with around 185,000 records, Kyndryl with 170,000, Gap Inc. with 80,000, Hexaware Technologies with 20,000, and Wyndham Hotels with 9,000.
Azure Credential Theft Campaign
Hudson Rock researchers who looked at sample data say the information seems very reliable. They mention that the email domains and data formats match typical Azure directory exports exactly.
The leaked data always has the same format. Key parts include full names, work email addresses from company sites and onmicrosoft.com, phone numbers, and addresses. Besides basic contact info, the data also shows details like employee IDs, job titles, departments, managers, and who reports to whom.
Many are worried about the sharing of access and group mapping details, including service account info and sometimes lists of Global Administrator accounts. Revealing this type of sensitive account info gives attackers a clear plan for spear-phishing, social tricks, and raising their privileges.
What is not clear is how the intrusions happened. TheHatman has said many times that the data was taken “using stolen credentials,” but the exact way they got in is still not confirmed, according to Hudson Rock.
Possible reasons are infostealer malware taking session tokens from worker computers, phishing attacks gaining admin-level access, tenants not using strict multi-factor authentication, or misuse of a third-party API with too wide reading permissions. The quick and steady dumps suggest a methodical, probably automated, process once the first access was gained.
Researchers at Hudson Rock found that stolen Azure login information is connected to infostealer attacks on many companies. This includes computers linked to workers at TCS, Gap Inc., HCL Technologies, and Kyndryl.
One hacked device had many corporate logins and a lot of sensitive session cookies, including direct access to a Kyndryl Azure Active Directory account. The presence of only large international companies in this campaign, instead of many smaller ones, suggests that the stolen logins are being targeted rather than a flaw in the Azure platform.
The actual risk is much bigger than just the initial leak. Bad actors often use this kind of structured data to carry out fake business email scams and spear-phishing attacks. They create fake emails that look real by using correct job titles and reporting lines to pretend to be managers or IT workers. This tricks employees into accepting fake money transfers or giving away MFA codes.
The leaking of service account details and admin names serves as a guide for hackers and ransomware groups searching for quick entry into important systems.
Organizations should see this incident as a reminder that keeping credentials safe matters more than just having strong defenses. Regular checks for stolen credentials, using MFA for all tenant portals, and careful review of third-party API permissions are important steps to prevent attacks.
