Loading story…
A threat actor using the alias "TheHatman" is advertising and selling data allegedly stolen from the Azure and Entra tenants of at least nine large enterprises, including McDonald’s, Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap Inc., Hexaware Technologies, and Wyndham Hotels. The exposed datasets reportedly contain millions of records and appear to be legitimate internal employee directory exports, including employee identities, contact details, job titles, manager relationships, organizational structure, group memberships, service accounts, and in some cases Global Administrator or other privileged account listings.
Researchers said the data samples appear credible and follow a consistent Azure directory export-like structure, increasing concern that the information was exfiltrated through compromised credentials rather than any underlying Azure platform flaw. Reporting points to a targeted credential-theft operation, with infostealer infections, phishing, weak MFA enforcement, or abuse of third-party API permissions cited as likely access paths; investigators also linked compromised Azure credentials tied to several affected firms. The exposure creates immediate risk of spear-phishing, business email compromise, social engineering, and privilege escalation against the impacted organizations.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
The threat actor 'TheHatman' began advertising alleged employee databases stolen from major companies' Azure or Entra tenants, claiming access via compromised credentials. The campaign ultimately advertised about 3.64 million records across multiple companies and included sample datasets for buyers.
Gap Inc. said its preliminary investigation found no evidence of a breach related to TheHatman's advertised Azure/Entra data. The company described the referenced information as limited in scope, non-sensitive, and several years old.
Tata Consultancy Services said it received threat-intelligence alerts about possible exposure of employee information but found no credible evidence of a breach of its systems or customer environments. TCS said the referenced data appears to be more than four years old, limited to basic employee information, and that customer, operational, and customer-system data were not impacted.
Hudson Rock reported finding compromised Azure credentials tied to infostealer infections associated with most of the affected companies, including specific links to Tata Consultancy Services, Gap, HCL Technologies, and Kyndryl. The researchers assessed that the victim pattern pointed to targeted credential theft rather than an underlying Azure platform vulnerability.
Hudson Rock said sample datasets appeared legitimate and matched the structure of Azure directory exports, with fields including employee identities, contact details, organizational hierarchy, service accounts, and in some cases privileged account listings. Researchers warned that the exposed information could support spear-phishing, business email compromise, and privilege escalation.
A threat actor using the alias 'TheHatman' offered for sale internal employee directory data allegedly stolen from at least nine large organizations' Azure and Entra tenants, including McDonald’s, Tata Consultancy Services, Vodafone, HCL Technologies, InterContinental Hotels Group, Kyndryl, Gap, Hexaware, and Wyndham Hotels. The actor claimed the data was obtained using compromised credentials.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
16 references tracked. Mallory keeps watching after this page renders.
rhisac.org
Open sourcesecuritymagazine.com
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourcesecurityweek.com
Open sourcecybersecuritynews.com
Open sourcehudsonrock.com
Open sourceinfostealers.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Credential compromise** and identity abuse are increasing as attackers rely more on stolen logins, session artifacts, and phishing rather than noisy exploitation alone. Recorded Future reported a sharp rise in exposed credentials during 2025, including nearly **2 billion** credentials indexed from malware combo lists, with the second half of the year up **50%** over the first and Q4 up **90%** over Q1. The trend is being driven by the industrialization of **infostealer malware**, malware-as-a-service ecosystems, and AI-enabled phishing and social engineering, while weak identity governance continues to expand the attack surface. A separate survey of UK organizations found **77%** fail to promptly disable former employees' accounts, **34%** grant overly broad access, and many still use manual processes such as spreadsheets for account validation, creating persistent opportunities for unauthorized access. A targeted phishing attempt against **Outpost24** illustrates how these identity-focused attacks are being operationalized against even security vendors. Attackers used a convincing fake JP Morgan email, valid **DKIM** authentication via Amazon SES infrastructure, and a **seven-stage redirect chain** leveraging trusted brands including Cisco to steer a C-suite executive toward a Microsoft Office credential-harvesting page while evading email defenses. The broader threat environment shows the same shift toward access abuse and stealthier post-compromise tradecraft: Google Threat Intelligence Group found ransomware actors increasingly favor native Windows tools over **Cobalt Strike**, with data theft present in **77%** of incidents and exploitation of VPNs and firewalls still common for initial access. Together, the reporting shows attackers are increasingly **logging in rather than breaking in**, then using legitimate access and built-in tools to deepen compromise and extort victims.
Jun 29, 2026
Microsoft disclosed a large-scale phishing campaign that targeted more than **35,000 users** at over **13,000 organizations** across **26 countries**, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals. Microsoft said the attackers used an **adversary-in-the-middle** phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as **Tycoon 2FA**, **Kratos**, and **EvilTokens**. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Jun 29, 2026
Accenture confirmed a cybersecurity breach after a threat actor using the name **"888"** advertised roughly **35 GB** of alleged company data for sale on a cybercrime forum. The seller claimed the cache included source code, configuration files, **RSA keys**, **SSH keys**, **Azure Personal Access Tokens**, and **Azure Storage access keys**, and reportedly shared a screenshot appearing to show an Azure DevOps repository tied to an Accenture domain being cloned. Independent verification of the full dataset and its authenticity was not available at the time of reporting. Accenture said it detected irregular activity, investigated the incident, contained the affected environment, remediated the source of the breach, and restored impacted systems. The company said operations and service delivery were not affected, but it has not disclosed how the intrusion occurred, how many systems or repositories were involved, whether the exposed credentials were valid, or whether any customer data or customer environments were impacted.
Jul 11, 2026