McDonald’s, Vodafone Hit in Massive Azure Credential Theft Campaign

A threat actor using the alias “TheHatman” is allegedly selling large corporate employee directories that were allegedly extracted from Microsoft Azure and Entra ID tenants using compromised credentials.

Recent posts on cybercrime forums advertise datasets linked to major multinational organizations, including McDonald’s, Vodafone, Tata Consultancy Services (TCS), HCL Technologies, Kyndryl, Gap Inc., InterContinental Hotels Group (IHG), Wyndham Hotels, and Hexaware.

While the exposed datasets appear consistent with legitimate Azure directory exports, the intrusion methods and the full scope of the campaign have not been independently verified.

Massive Azure Credential Theft Campaign

The actor claims to possess more than 1.7 million records from McDonald’s, approximately 800,000 from TCS, 425,000 from Vodafone, 250,000 from HCL Technologies, and 170,000 from Kyndryl.

Other advertised data includes around 185,000 IHG records, 80,000 from Gap Inc., 20,000 from Hexaware, and 9,000 from Wyndham Hotels.

If accurate, this campaign represents one of the most extensive suspected directory-data collection operations targeting large Azure environments.

The concentration of affected enterprises across sectors such as hospitality, telecommunications, IT services, retail, and logistics suggests that the actor may be pursuing organizations with large, globally distributed workforces.

Sample datasets reportedly contain fields typically returned through Microsoft Entra directory queries and administrative exports, such as display names, employee IDs, corporate email addresses, User Principal Names (UPNs), telephone numbers, office details, job titles, department names, manager relationships, notes, direct reports, group memberships, and service account references.

Some records reportedly identify privileged users, including Global Administrators. While this data may not contain passwords or direct access tokens, it can provide attackers with a comprehensive overview of an organization’s identity infrastructure and internal hierarchy.

The immediate concern is the potential for weaponization. Threat actors can use manager-reporting relationships, department information, and valid internal email formats to create highly convincing spear-phishing and business email compromise campaigns.

For example, an attacker posing as a finance executive, service-desk employee, or Microsoft administrator could tailor messages to align with the target’s role and reporting structure.

Lists of privileged accounts and service identities can also help initial-access brokers prioritize high-value targets for credential harvesting, MFA fatigue attacks, token theft, lateral movement, or ransomware deployment.

An email impersonating a known manager could direct an employee to approve a fraudulent Microsoft sign-in request by referencing the correct department and internal project context.

Affected Organizations

Organization	Sector	Alleged Records Exposed
McDonald’s Corporation	Hospitality / Retail	1,700,000+
Tata Consultancy Services (TCS)	IT Services	800,000+
Vodafone	Telecommunications	425,000+
HCL Technologies	IT Services	250,000+
InterContinental Hotels Group (IHG)	Hospitality	185,000+
Kyndryl	IT Services	170,000+
Gap Inc.	Retail	80,000+
Hexaware Technologies	IT Services	20,000+
Wyndham Hotels	Hospitality	9,000+

The actor claims the information was obtained via compromised credentials, but the initial access method remains unclear.

Possible scenarios include infostealer malware infections, stolen browser sessions and cookies, password reuse, phishing, weak or inconsistently enforced multi-factor authentication (MFA), or third-party applications with excessive directory-read permissions.

Researchers have reportedly connected infostealer-associated Microsoft credentials to several affected organizations, making endpoint credential theft a plausible explanation.

According to Hudson Rock, the selective focus on major enterprises may indicate targeted access brokerage rather than a widespread vulnerability in Azure.

Organizations should immediately review Entra ID sign-in logs, audit directory-read activity, identify unusual Microsoft Graph API queries, revoke active sessions for suspicious accounts, rotate exposed credentials, and validate privileged-role assignments.

Security teams should also enforce phishing-resistant MFA, apply conditional access controls, reduce unnecessary directory permissions, and monitor endpoints for infostealer activity.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world