[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXEaNc_LwVwbOdmr_puvPi94SKEjnz9Hs9OOaIG2QljI":3,"$ffeoydrKJYihgInmLLv0QCKZOFX3igs1hpb2npfgYXKg":81},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":78,"created_at":79,"updated_at":80,"published_at":24},"palo-alto-unit-42-details-thehatman-s-august-2026-credential-attack-campaign","Palo Alto Unit 42 details TheHatman's August 2026 credential attack campaign","TheHatman claims 3.6M Azure\u002FEntra records from nine organizations including McDonald's, Gap, Vodafone, TCS, HCL, IHG, and Kyndryl, using MFA fatigue and password spraying.","Palo Alto Networks Unit 42 published a threat brief on August 18, 2026, detailing TheHatman's large-scale credential attack campaign that ran from August 1–17, 2026, where the actor exfiltrated ~3.6M employee records from Microsoft Entra tenants and sold them across multiple forums.",[10,11,12,13,14,15],"TheHatman","Palo Alto Unit 42","Microsoft Entra","password spraying","MFA fatigue","Azure","# Palo Alto Unit 42 details TheHatman's August 2026 credential attack campaign\n\n*TheHatman claims 3.6M Azure\u002FEntra records from nine organizations including McDonald's, Gap, Vodafone, TCS, HCL, IHG, and Kyndryl, using MFA fatigue and password spraying.*\n\n**Tags:** `TheHatman` `Palo Alto Unit 42` `Microsoft Entra` `password spraying` `MFA fatigue` `Azure`\n\n> Palo Alto Networks Unit 42 published a threat brief on August 18, 2026, detailing TheHatman's large-scale credential attack campaign that ran from August 1–17, 2026, where the actor exfiltrated ~3.6M employee records from Microsoft Entra tenants and sold them across multiple forums.\n\n---\n\n## TheHatman's 3.6M-Record Azure Haul\n\nPalo Alto Networks Unit 42 has published a threat brief detailing a large-scale credential campaign by the actor TheHatman, who claimed to have exfiltrated 3.6 million records from nine organizations’ Microsoft Entra tenants in August 2026.\n\nThe campaign, active from August 1 through August 17, 2026, saw TheHatman post data dumps across multiple forums for sale. The largest dataset is McDonald’s, with 1.7 million records, followed by TCS at 800,000, Vodafone at 425,000, and HCL at 250,000. The remaining four organizations are IHG, Kyndryl, and Gap, the latter holding 80,000 records.\n\nThe data includes full names, email addresses, employee IDs, phone numbers, postal addresses, and service accounts. Unit 42 notes the data was allegedly exfiltrated from the organizations’ Microsoft Entra tenants, with the actor claiming access via compromised credentials through MFA fatigue and password spraying attacks.\n\n## How the Credentials Were Stolen\n\nTheHatman claims the data was pulled from the organizations’ Microsoft Entra tenants using compromised credentials, specifically via MFA fatigue and password spraying attacks. The actor did not specify which tenants were hit first or whether the same credential set was reused across all nine organizations.\n\nHudson Rock, which analyzed the dumps, found infostealer-derived credentials in its database for most of the named companies. The firm said the credentials matched the Microsoft cloud accounts associated with the affected tenants, though it could not independently link those credentials to TheHatman’s initial access. Hudson Rock characterized the initial access vector as “highly likely” to be an infostealer chain rather than a zero-day, given the scale of the targets and the typical credential reuse pattern seen in infostealer harvests.\n\n## The Campaign Timeline\n\nThe campaign began on July 31, 2026, when TheHatman posted the first data dumps for sale on underground forums, starting with McDonald’s and Gap. The actor’s post for McDonald’s reads: “I’m selling McDonald’s Corporation internal employee dump downloaded directly from Azure Tenant using compromised credentials.”\n\nFrom August 1 through August 17, TheHatman posted across multiple forums, offering employee data for the remaining seven organizations. Each listing included a sample database for buyers to verify the full dump. The actor claimed the data was exfiltrated directly from the organizations’ Microsoft Entra tenants using compromised credentials, specifically via MFA fatigue and password spraying attacks.\n\nPublic reporting surfaced on August 16, 2026, when the campaign was first disclosed. Palo Alto Networks Unit 42 followed with initial mitigation guidance via social media the same day, before publishing the full threat brief on August 18.\n\n## Who Was Hit\n\nMcDonald’s holds the largest dataset at 1.7 million records, followed by TCS at 800,000, Vodafone at 425,000, and HCL at 250,000. IHG and Kyndryl each account for roughly 170,000 records, while Gap Inc. closes out the list with 80,000. The seven organizations span quick-service restaurant, IT services, telecom, and hospitality, with McDonald’s and Gap as the most recognizable consumer brands in the set.\n\n## Why This Matters for Entra\n\nEntra has become the new perimeter. Attackers no longer need to break in through a WAF or RCE; they log in with valid credentials. TheHatman’s campaign against nine organizations — McDonald’s, Gap, Vodafone, TCS, HCL, IHG, Kyndryl, and two others — is a clean example: 3.6 million records pulled directly from Microsoft Entra tenants using compromised credentials.\n\nThe initial access vector is the interesting part. TheHatman claims MFA fatigue and password spraying, which is how you beat MFA at scale. Hudson Rock’s analysis found infostealer-derived credentials in its database for most of the named companies, which is the typical pattern: infostealer harvests the cloud credentials, then the actor sprays them across the tenant. The actor didn’t specify which tenants were hit first or whether the same credential set was reused across all nine, but the scale and target mix make infostealer the most likely source rather than a zero-day.\n\nService accounts are what make this dangerous. The dumps include service accounts alongside the user accounts, which gives the attacker lateral movement and persistence inside the cloud tenant. Once you have a service account with Global Administrator or Directory Reader, you can enumerate the full directory, register new apps, and pivot to other tenants in the same AAD tenant. That’s the difference between a credential leak and a full tenant compromise.\n\n## Key points\n\n- TheHatman ran the campaign from Aug 1–17, 2026, posting data dumps for nine organizations including McDonald's (1.7M records), Gap Inc. (80K), Vodafone (425K), TCS (800K), HCL (250K), IHG, and Kyndryl (170K).\n- The actor claims the data was exfiltrated from Microsoft Entra tenants using compromised credentials via MFA fatigue and password spraying, though Unit 42 could not verify the specific intrusion vector.\n- The data includes full names, employee IDs, email addresses, job titles, phone numbers, postal addresses, and service accounts from each tenant.\n- Unit 42 published the threat brief on August 18, 2026, with initial guidance shared via social media as early as Aug 16.\n- The campaign is part of a broader trend where cybercriminals log in with stolen credentials instead of exploiting a vulnerability, targeting internet-exposed services and cloud identity providers.\n\n## Further reading & sources\n\n- [Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)](https:\u002F\u002Funit42.paloaltonetworks.com\u002Flarge-scale-credential-attacks) — PaloAlto Networks Unit 42\n- [Hacker claims 3.6 million Azure account records stolen from major companies](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhacker-claims-36-million-azure-account-records-stolen-from-major-companies\u002F)\n- [Crook hawks millions of records allegedly plundered from corporate Azure tenants](https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F08\u002F17\u002Fcrook-hawks-millions-of-records-allegedly-plundered-from-corporate-azure-tenants\u002F5288305)\n- [TheHatman Claims 3.6M Records Linked to Azure Environments Across Nine Organizations - ThreatMon](https:\u002F\u002Fthreatmon.io\u002Fazure-credential-theft-campaign)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-details-thehatman-s-august-2026-credential-attack-campaign.png?v=a517fffda4",{"actors":19,"malware":26,"targets":29,"timeline":50,"industries":59,"technologies":73},[20],{"url":21,"name":10,"slug":22,"type":23,"origin":24,"motivation":25},"\u002Fthreat-groups\u002Fthehatman","thehatman","unknown",null,"Data theft and exfiltration",[27],{"name":28},"infostealer",[30,35,38,42,45,48],{"name":31,"sector":32,"status":33,"geography":34},"McDonald's","Food & Beverage","claimed","US",{"name":36,"sector":37,"status":33,"geography":34},"Gap Inc.","Retail",{"name":39,"sector":40,"status":33,"geography":41},"Vodafone","Telecommunications","UK",{"name":43,"sector":44,"status":33,"geography":24},"IHG","Hospitality",{"name":46,"sector":47,"status":33,"geography":24},"TCS","IT Services",{"name":49,"sector":37,"status":33,"geography":24},"Gap",[51,55],{"date":52,"event":53,"description":54},"2026-07-31","Campaign start","TheHatman starts advertising data dumps",{"date":56,"event":57,"description":58},"2026-08-16","Campaign end","Last data dump posted (McDonald's 1.7M records)",[60,63,66,69],{"url":61,"name":37,"slug":62},"\u002Findustries\u002Fretail","retail",{"url":64,"name":40,"slug":65},"\u002Findustries\u002Ftelecommunications","telecommunications",{"url":67,"name":44,"slug":68},"\u002Findustries\u002Fhospitality","hospitality",{"url":70,"name":71,"slug":72},"\u002Findustries\u002Finformation-technology-services","Information Technology Services","information-technology-services",[74,76],{"vendor":75,"product":15},"Microsoft",{"vendor":75,"product":77},"Entra","threat_actor_activity","2026-09-17T17:06:03.041262+00:00","2026-10-16T12:28:34.992009+00:00",{"articles":82},[83,94,104,117],{"slug":84,"title":85,"summary":86,"tags":87,"hero_image_url":92,"story_type":78,"created_at":93},"palo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production","Palo Alto Unit 42: 405 AI-enabled malware samples show 12 in production","Palo Alto Networks Unit 42 analyzed 405 AI-enabled malware samples and found the space is dominated by PoC and researcher code, with only 12 samples hitting production endpoints across five distinct malware families.",[88,89,11,90,91],"AI malware","FunkSec","ransomware","LLM","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpalo-alto-unit-42-405-ai-enabled-malware-samples-show-12-in-production.png?v=efb3f6f578","2026-09-26T12:10:59.266452+00:00",{"slug":95,"title":96,"summary":97,"tags":98,"hero_image_url":102,"story_type":78,"created_at":103},"teampcp-drops-new-malware-into-42-microsoft-github-repositories","TeamPCP Drops New Malware into 42 Microsoft GitHub Repositories","TeamPCP leveraged a stolen GitHub account to publish malicious code into at least 42 repositories and 236 branches spanning the Azure, Azure-Samples, and Microsoft GitHub organizations, extending its ongoing supply-chain campaign against Microsoft-linked projects.",[99,100,101,75,15],"TeamPCP","supply-chain","GitHub","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fteampcp-drops-new-malware-into-42-microsoft-github-repositories.png?v=b35dbe0163","2026-08-26T17:02:14.429711+00:00",{"slug":105,"title":106,"summary":107,"tags":108,"hero_image_url":115,"story_type":78,"created_at":116},"russian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in","Russian State Actors Exploit Exposed IP Cameras to Track NATO Troop Movements in Ukraine","The Netherlands' AIVD and MIVD released a joint advisory warning that Russian state actors are systematically exploiting publicly exposed IP cameras to track NATO troop and supply movements in the ongoing Ukraine war.",[109,110,111,112,113,114],"Russia","IP Camera","NATO","Ukraine","AIVD","MIVD","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Frussian-state-actors-exploit-exposed-ip-cameras-to-track-nato-troop-movements-in.png?v=74b95987f5","2026-09-30T07:07:04.966623+00:00",{"slug":118,"title":119,"summary":120,"tags":121,"hero_image_url":128,"story_type":78,"created_at":129},"fancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report","Fancy Bear AI-Enabled Attacks Surge 89% in CrowdStrike 2026 Report","CrowdStrike's 2026 Global Threat Report shows Fancy Bear (APT28) AI-enabled adversary activity up 89% year-over-year, eCrime average breakout time at 29 minutes, and GenAI prompt injection confirmed at 90+ organizations.",[122,123,124,125,126,127],"Fancy Bear","APT28","CrowdStrike","LLM malware","GenAI prompt injection","eCrime","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffancy-bear-ai-enabled-attacks-surge-89-in-crowdstrike-2026-report.png?v=f7ed8c119c","2026-09-29T12:06:38.382267+00:00"]