FlagThis — Daily Cybersecurity Intelligence Briefing

A large-scale exfiltration campaign has targeted Azure/Entra ID tenants across multiple Fortune 500 organizations, resulting in the leakage of millions of internal employee records. The threat actor, identified as 'TheHatman,' utilized compromised credentials—likely obtained via Infostealer-driven session token theft—to access corporate directories through Azure/Entra portals and the Azure CLI. Exfiltrated datasets comprise core identities, detailed organizational metadata, and sensitive access control information, including service account listings and Global Administrator records. This breach provides high-value intelligence that significantly facilitates downstream high-impact attacks, such as Business Email Compromise (BEC), advanced spear-phishing, and ransomware deployment through lateral movement and privilege escalation.