A sprawling Azure data exfiltration campaign is unfolding across the dark web, with a threat actor systematically selling internal employee directories allegedly stolen from some of the world’s largest corporations.
The seller, operating under the alias “TheHatman,” claims to have obtained the records directly from victims’ Azure and Entra tenants using compromised credentials. The scale of the data reportedly exposed is significant.
Over the past week, TheHatman has posted listings for at least nine major enterprises spanning IT services, hospitality, telecommunications, retail, and logistics.
McDonald’s Corporation reportedly tops the list with more than 1.7 million exposed records, followed by Tata Consultancy Services with roughly 800,000, Vodafone with approximately 425,000, and HCL Technologies with around 250,000.
Additional reported victims include:
- InterContinental Hotels Group: ~185,000 records
- Kyndryl: ~170,000 records
- Gap Inc.: ~80,000 records
- Hexaware Technologies: ~20,000 records
- Wyndham Hotels: ~9,000 records
Azure Credential Theft Campaign
Researchers at Hudson Rock who reviewed sample datasets said the information appears highly credible, citing corporate email domains and data structures consistent with Azure directory exports.
The datasets reportedly contain a wide range of employee information, including:
- Full names
- Corporate email addresses
- Phone numbers
- Physical addresses
- Employee IDs
- Job titles
- Departments
- Manager relationships
- Direct reports
- Service account information
- Group membership data
- Global Administrator account information
The exposure of privileged account information is particularly concerning because it can provide attackers with a detailed organizational map for spear-phishing, social engineering, credential theft, and privilege escalation.
How Were the Azure Tenants Compromised?
The exact initial access mechanism remains unclear.
TheHatman claims the information was obtained using compromised credentials, but Hudson Rock has not confirmed precisely how those credentials were acquired or how the attackers gained access to the affected tenants.
Several possibilities exist, including:
- Infostealer malware harvesting credentials and session cookies
- Phishing campaigns targeting employees or administrators
- Insufficient MFA enforcement
- Theft of authentication tokens
- Excessive permissions granted to third-party applications
- Abuse of compromised API credentials or integrations
The consistency and speed of the data collection suggest that the attackers may have automated much of the process after obtaining an initial foothold.
Hudson Rock researchers also identified compromised Azure credentials associated with infostealer infections linked to employees at several affected organizations, including TCS, Gap, HCL Technologies, and Kyndryl.
In one case, a compromised device reportedly contained dozens of corporate credentials and hundreds of sensitive session cookies, including access to a Kyndryl Azure Active Directory account.
The concentration of victims among large multinational organizations suggests the campaign is primarily focused on high-value enterprise credentials, rather than exploiting a vulnerability in the Azure platform itself.
Enterprise Data Could Fuel Follow-On Attacks
The leaked information creates risks far beyond the initial exposure.
Accurate employee directories can be used to construct highly convincing business email compromise (BEC) and spear-phishing campaigns. Attackers can identify managers, direct reports, IT personnel, and other employees with access to sensitive systems.
For example, knowing an employee's exact:
- Job title
- Manager
- Department
- Corporate email address
- Reporting structure
can make impersonation attempts significantly more convincing.
The exposure of service accounts and Global Administrator information is even more valuable to attackers. Such information can help identify potential privilege-escalation targets and provide initial access brokers or ransomware operators with a roadmap of an organization's identity infrastructure.
Defensive Recommendations
Organizations using Microsoft Azure and Entra should treat compromised credentials as a serious identity-security risk and prioritize:
- Enforce phishing-resistant MFA for privileged and high-value accounts.
- Monitor for infostealer-compromised credentials and session cookies.
- Revoke active sessions and refresh tokens following suspected credential exposure.
- Rotate credentials for privileged and service accounts.
- Review Global Administrator assignments and remove unnecessary privileges.
- Audit third-party applications and API permissions for excessive access.
- Monitor unusual Entra authentication activity, including impossible travel, unfamiliar devices, and abnormal token usage.
- Implement continuous dark-web and credential-leak monitoring for corporate identities.
The campaign highlights an increasingly important security reality: cloud identity security is now inseparable from endpoint security. A compromised employee device can provide attackers with the credentials and session tokens needed to access enterprise cloud environments without exploiting a traditional software vulnerability.
