Precursor Intelligence

Threat News

Latest cyber threat intelligence, breaches and exploitation

1 matching story

MFA fatigue
  • Threat Actor Activity17 Sept 2026·4 sources

    Palo Alto Unit 42 details TheHatman's August 2026 credential attack campaign

    Palo Alto Networks Unit 42 published a threat brief on August 18, 2026, detailing TheHatman's large-scale credential attack campaign that ran from August 1–17, 2026, where the actor exfiltrated ~3.6M employee records from Microsoft Entra tenants and sold them across multiple forums.

    TheHatmanPalo Alto Unit 42Microsoft Entra+3
    Palo Alto Unit 42 details TheHatman's August 2026 credential attack campaign