Azure Credential Theft Campaign Exposes Millions of Enterprise Records

A large-scale credential theft and data-exfiltration campaign is targeting major enterprises by abusing compromised credentials to access Microsoft Azure and Entra ID tenants.

The threat actor operating under the alias “TheHatman” has reportedly advertised employee-directory datasets belonging to at least nine major enterprises on underground forums.

Hudson Rock researchers reviewed samples of the datasets and assessed them as highly credible based on corporate email domains and structures consistent with Azure directory exports.

Key Highlights

• Threat actor: TheHatman
• Target platform: Microsoft Azure / Entra ID
• At least 9 major enterprises reportedly affected.
• More than 1.7 million records associated with McDonald's.
• Approximately 800,000 records associated with Tata Consultancy Services.
• Approximately 425,000 records associated with Vodafone.
• Approximately 250,000 records associated with HCL Technologies.
• Additional datasets associated with IHG, Kyndryl, Gap, Hexaware and Wyndham.
• Data includes employee identities, contact information and organizational relationships.
• Some datasets contain service-account information and Global Administrator account details.
• Hudson Rock identified compromised Azure credentials associated with infostealer infections.
• The precise initial-access mechanism remains unconfirmed.

Reported Victims

The campaign reportedly exposed data belonging to multiple large enterprises:

These figures represent records advertised or reported in the campaign and should not automatically be interpreted as independently confirmed breach totals for every organization.

Azure and Entra ID Data Exposure

The leaked datasets reportedly contain information consistent with standard Azure directory exports.

Exposed information includes:

• Full names
• Corporate email addresses
• onmicrosoft.com tenant addresses
• Phone numbers
• Physical addresses
• Employee IDs
• Job titles
• Departments
• Manager relationships
• Direct reports
• Service-account information
• Group membership information
• Global Administrator account information

The combination of identity and organizational data creates a detailed map of the targeted enterprise.

Credential-Based Access

The threat actor claims that the information was obtained using compromised credentials.

However, the precise initial-access technique has not been confirmed.

Potential mechanisms discussed by researchers include:

• Infostealer malware stealing credentials
• Theft of browser session cookies or tokens
• Phishing campaigns
• Compromised administrator accounts
• Insufficient MFA protection
• Abuse of third-party APIs
• Overly permissive application integrations

Hudson Rock identified compromised Azure credentials linked to infostealer infections associated with several affected organizations, strengthening the possibility that stolen endpoint credentials and session information played a role.

Infostealer Connection

Infostealer malware can collect credentials and session information directly from employee endpoints.

A compromised device associated with one affected organization reportedly contained:

• Dozens of corporate credentials
• Hundreds of sensitive session cookies
• Access to an Azure Active Directory account

This demonstrates how an endpoint infection can potentially become the starting point for cloud-tenant compromise.

The campaign therefore highlights the connection between endpoint infostealer infections and cloud identity compromise.

Global Administrator Exposure

One of the most concerning aspects of the datasets is the inclusion of information about privileged accounts.

Global Administrator account information can provide attackers with a valuable targeting list.

Even when passwords are not directly exposed, the information can be used to conduct:

• Spear-phishing
• Business email compromise
• MFA social engineering
• Credential attacks
• Privilege escalation attempts
• Targeted identity attacks

The organizational reporting structure also enables attackers to impersonate managers, administrators and IT personnel more convincingly.

Potential Attack Chain

A potential attack chain can be represented as:

Infostealer Infection → Credential/Session Theft → Azure/Entra Authentication → Directory Enumeration → Employee & Group Discovery → Privileged Account Identification → Data Exfiltration → Targeted Phishing / Further Compromise

The exact attack chain used by TheHatman has not been conclusively established.

Business Impact

The exposed information creates risks beyond the initial data theft.

Threat actors can use organizational directories to conduct highly targeted attacks against employees.

Potential consequences include:

• Business Email Compromise
• Spear-phishing
• Credential theft
• MFA-code theft through social engineering
• Privilege escalation
• Identity impersonation
• Service-account targeting
• Ransomware initial access
• Further cloud compromise
• Targeted financial fraud

The exposed reporting structure can make fraudulent communications appear significantly more credible.

Detection and Hunting Opportunities

Security teams should monitor for:

• Azure sign-ins from unusual locations
• Impossible-travel authentication events
• Authentication using unfamiliar devices
• New OAuth applications
• Suspicious enterprise application consent
• Unexpected service-principal activity
• Unusual Microsoft Graph API queries
• Large-scale directory enumeration
• Abnormal access to users and groups
• Unexpected Global Administrator activity
• New privileged-role assignments
• Unusual service-account authentication
• Suspicious mailbox access
• Mass downloads from Azure or Microsoft 365
• Access following an infostealer infection
• Session-token reuse from unfamiliar IP addresses
• Authentication immediately following credential exposure

Recommended Mitigations

1. Enforce MFA across all Azure and Entra ID accounts.
2. Prefer phishing-resistant authentication such as passkeys or FIDO2 security keys.
3. Monitor Entra ID sign-ins for anomalous locations and devices.
4. Investigate credentials associated with known infostealer infections.
5. Revoke active sessions following suspected credential theft.
6. Reset compromised passwords and rotate exposed secrets.
7. Review Global Administrator accounts and minimize their number.
8. Audit service accounts and privileged identities.
9. Review third-party application permissions.
10. Remove unnecessary OAuth grants and application consent.
11. Implement Conditional Access policies.
12. Monitor privileged-role assignments.
13. Implement Privileged Identity Management for administrative roles.
14. Monitor large-scale directory enumeration.
15. Review endpoint telemetry for infostealer infections.
16. Conduct retrospective searches for suspicious Azure authentication after endpoint compromise.

Threat Assessment

This campaign demonstrates the growing convergence between infostealer malware, identity compromise and cloud data theft.

An attacker does not necessarily need to exploit a vulnerability in Azure itself. Compromised employee credentials and session tokens can provide a direct path into cloud environments.

The exposure of organizational relationships and privileged-account information further increases the risk by giving attackers a detailed blueprint for subsequent identity-based attacks.

Conclusion

Organizations should treat compromised credentials associated with infostealer infections as a potential cloud security incident, not merely an endpoint malware event.

Security teams should correlate endpoint detections with Azure and Entra ID authentication logs, immediately revoke exposed sessions, rotate credentials and investigate privileged-account activity.

Continuous monitoring of cloud identities, service accounts, OAuth applications and privileged roles is essential to reduce the risk of stolen credentials being converted into large-scale cloud data exposure.