Massive Azure Exfiltration Campaign Exposes Millions of Records from Fortune 500 Companies

A significant Azure exfiltration campaign has emerged, with a threat actor named 'TheHatman' selling internal employee directories from major corporations, including McDonald's and Vodafone. These records were reportedly downloaded from the organizations' Azure/Entra portals using compromised credentials. The scale of the data breach is staggering, impacting multiple global enterprises across various sectors such as IT services, hospitality, and telecommunications. The compromised data includes foundational corporate directory attributes, raising concerns about potential social engineering and targeted attacks. While the exact method of intrusion remains unclear, it is suspected that Infostealer infections played a significant role. Researchers have linked compromised Azure credentials to these infections, indicating that the breach likely stems from targeted exploitation rather than a systemic vulnerability in Azure. The exposure of these internal directories poses an immediate threat to the affected enterprises.

Key Points: • The threat actor 'TheHatman' is selling employee records from Fortune 500 companies. • Compromised credentials were used to access Azure/Entra portals for data exfiltration. • The breach impacts multiple sectors, including IT, hospitality, and telecommunications.