InfoSecBulletin Cybersecurity for mankind
A large Azure data theft campaign is surfacing on the dark web. A hacker is offering employee lists taken from big companies around the world. The seller, operating under the alias “TheHatman,” claims to have pulled these records directly from victim organizations’ Azure and Entra tenants using compromised credentials, and the volume of data on offer is staggering.
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
Multiple European supermarket fridges got hacked: Temperatures reached high as 55°C
Apple Warns 99 Countries iPhone Users of Mercenary Spyware Attacks
Daily Cyber security update for 31.10. 2026
TheHatman has filled underground forums this past week with listings for at least nine big companies in IT services, hotels, telecom, retail, and logistics.
According to the claim, McDonald’s Corporation has the most exposed records with over 1.7 million. Tata Consultancy Services comes next with about 800,000 records. Vodafone has around 425,000, and HCL Technologies has about 250,000.
Additional victims are InterContinental Hotels Group with around 185,000 records, Kyndryl with 170,000, Gap Inc. with 80,000, Hexaware Technologies with 20,000, and Wyndham Hotels with 9,000.
Azure Credential Theft Campaign
Hudson Rock researchers who looked at sample data say the information seems very reliable. They mention that the email domains and data formats match typical Azure directory exports exactly.
The leaked data always has the same format. Key parts include full names, work email addresses from company sites and onmicrosoft.com, phone numbers, and addresses. Besides basic contact info, the data also shows details like employee IDs, job titles, departments, managers, and who reports to whom.
Many are worried about the sharing of access and group mapping details, including service account info and sometimes lists of Global Administrator accounts. Revealing this type of sensitive account info gives attackers a clear plan for spear-phishing, social tricks, and raising their privileges.
What is not clear is how the intrusions happened. TheHatman has said many times that the data was taken “using stolen credentials,” but the exact way they got in is still not confirmed, according to Hudson Rock.
Possible reasons are infostealer malware taking session tokens from worker computers, phishing attacks gaining admin-level access, tenants not using strict multi-factor authentication, or misuse of a third-party API with too wide reading permissions. The quick and steady dumps suggest a methodical, probably automated, process once the first access was gained.
Researchers at Hudson Rock found that stolen Azure login information is connected to infostealer attacks on many companies. This includes computers linked to workers at TCS, Gap Inc., HCL Technologies, and Kyndryl.
One hacked device had many corporate logins and a lot of sensitive session cookies, including direct access to a Kyndryl Azure Active Directory account. The presence of only large international companies in this campaign, instead of many smaller ones, suggests that the stolen logins are being targeted rather than a flaw in the Azure platform.
The actual risk is much bigger than just the initial leak. Bad actors often use this kind of structured data to carry out fake business email scams and spear-phishing attacks. They create fake emails that look real by using correct job titles and reporting lines to pretend to be managers or IT workers. This tricks employees into accepting fake money transfers or giving away MFA codes.
The leaking of service account details and admin names serves as a guide for hackers and ransomware groups searching for quick entry into important systems.
Organizations should see this incident as a reminder that keeping credentials safe matters more than just having strong defenses. Regular checks for stolen credentials, using MFA for all tenant portals, and careful review of third-party API permissions are important steps to prevent attacks.
