Massive Azure Exfiltration Campaign Exposes Millions of Enterprise Records via Compromised Credentials

Key Points:

• A large-scale Azure exfiltration campaign led by a threat actor known as "TheHatman" has resulted in the exposure of millions of enterprise employee records from multiple Fortune 500 companies, obtained via compromised credentials.
• Affected organizations span various industries including IT services, hospitality, telecommunications, retail, and logistics, with leaked data containing detailed corporate directory information such as employee contact details, organizational structure, and privileged account access.
• The exact method of intrusion remains unclear, but researchers suspect the use of compromised credentials from Infostealer infections, phishing attacks, or inadequate Multi-Factor Authentication (MFA), rather than a systemic Azure vulnerability.
• The leaked data includes sensitive information like global administrator accounts and service accounts, heightening risks of targeted social engineering, spear-phishing, and privilege escalation attacks against the impacted enterprises.
• This exposure significantly increases the likelihood of sophisticated Business Email Compromise (BEC) scams, as attackers can leverage the detailed organizational data to impersonate internal personnel and manipulate employees into fraudulent actions.