InfoSecBulletin Cybersecurity for mankind
A large Azure data theft campaign is surfacing on the dark web. A hacker is offering employee lists taken from big companies around the world. The seller, operating under the alias “TheHatman,” claims to have pulled these records directly from victim organizations’ Azure and Entra tenants using compromised credentials, and the volume of data on offer is staggering.
McDonald’s, Vodafone Affected by Azure Theft Campaign Exposing Millions of Records
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Palo Alto Patches 11 New flaws Across PAN-OS, GlobalProtect, and Prisma Access
CVE-2026-20349, CVE-2026-68820
Cisco and Windows patched zero days exploited in attack
Microsoft Patch 394 Flaws, Including 3 Zero-Days
TheHatman has filled underground forums this past week with listings for at least nine big companies in IT services, hotels, telecom, retail, and logistics.
According to the claim, McDonald’s Corporation has the most exposed records with over 1.7 million. Tata Consultancy Services comes next with about 800,000 records. Vodafone has around 425,000, and HCL Technologies has about 250,000.
Additional victims are InterContinental Hotels Group with around 185,000 records, Kyndryl with 170,000, Gap Inc. with 80,000, Hexaware Technologies with 20,000, and Wyndham Hotels with 9,000.
Azure Credential Theft Campaign
Hudson Rock researchers who looked at sample data say the information seems very reliable. They mention that the email domains and data formats match typical Azure directory exports exactly.
The leaked data always has the same format. Key parts include full names, work email addresses from company sites and onmicrosoft.com, phone numbers, and addresses. Besides basic contact info, the data also shows details like employee IDs, job titles, departments, managers, and who reports to whom.
Many are worried about the sharing of access and group mapping details, including service account info and sometimes lists of Global Administrator accounts. Revealing this type of sensitive account info gives attackers a clear plan for spear-phishing, social tricks, and raising their privileges.
What is not clear is how the intrusions happened. TheHatman has said many times that the data was taken “using stolen credentials,” but the exact way they got in is still not confirmed, according to Hudson Rock.
Possible reasons are infostealer malware taking session tokens from worker computers, phishing attacks gaining admin-level access, tenants not using strict multi-factor authentication, or misuse of a third-party API with too wide reading permissions. The quick and steady dumps suggest a methodical, probably automated, process once the first access was gained.
Researchers at Hudson Rock found that stolen Azure login information is connected to infostealer attacks on many companies. This includes computers linked to workers at TCS, Gap Inc., HCL Technologies, and Kyndryl.
One hacked device had many corporate logins and a lot of sensitive session cookies, including direct access to a Kyndryl Azure Active Directory account. The presence of only large international companies in this campaign, instead of many smaller ones, suggests that the stolen logins are being targeted rather than a flaw in the Azure platform.
The actual risk is much bigger than just the initial leak. Bad actors often use this kind of structured data to carry out fake business email scams and spear-phishing attacks. They create fake emails that look real by using correct job titles and reporting lines to pretend to be managers or IT workers. This tricks employees into accepting fake money transfers or giving away MFA codes.
The leaking of service account details and admin names serves as a guide for hackers and ransomware groups searching for quick entry into important systems.
Organizations should see this incident as a reminder that keeping credentials safe matters more than just having strong defenses. Regular checks for stolen credentials, using MFA for all tenant portals, and careful review of third-party API permissions are important steps to prevent attacks.
