How TheHatman stole 1.7 million McDonald's records without touching a firewall
On August 16, 2026, threat intelligence firm Hudson Rock published a detailed breakdown of a cloud exfiltration campaign they attributed to a threat actor operating as "TheHatman." The actor had listed internal employee directories from at least nine Fortune 500-level enterprises for sale on underground forums. McDonald's topped the list with more than 1.7 million exposed records. Tata Consultancy Services had roughly 800,000. Vodafone had 425,000. HCL Technologies had 250,000.
No network intrusion was used. No phishing campaign targeted the victim companies. No vulnerability was exploited. The entire operation ran through legitimate Microsoft Graph API calls, authenticated with credentials purchased from criminal info-stealer log marketplaces.
How the attack works
Info-stealer malware, once installed on an employee's device, harvests saved credentials, session cookies, browser history, and authentication tokens before exfiltrating them to a command-and-control server. That data is packaged into logs and sold on criminal marketplaces, often within hours of theft.
TheHatman purchased these logs, extracted Azure or Microsoft 365 credentials belonging to employees at target organizations, and used those credentials to authenticate directly to the victim's Azure Entra tenant. From there, Microsoft Graph API provides any authenticated user with the ability to enumerate the Entra directory based on their assigned permissions. Service accounts and developer accounts are routinely over-provisioned, and many organizations have not scoped their directory read permissions down from the broad defaults.
The entire process produces no alerts in standard EDR tools, no firewall events, and no network anomalies. It looks, from a detection standpoint, exactly like a legitimate user accessing a legitimate API with legitimate credentials.
Why this matters beyond the headline names
The victims listed by Hudson Rock are large, recognizable organizations with mature security programs. They almost certainly have enterprise EDR, SIEM, and conditional access policies. The attack bypassed all of it.
This is not a vulnerability in Microsoft Azure. There is no patch to apply. The attack exploits the organizational gap between endpoint credential hygiene and cloud identity governance: the devices that employees use to authenticate to Azure are not always the devices that corporate security controls protect. A personal laptop, a contractor device, or a compromised home machine that a user authenticates from can produce credentials that grant cloud access indistinguishable from a clean session.
The McAfee-era model of perimeter defense assumes the network boundary is the thing worth protecting. The TheHatman campaign illustrates that the credential, not the network, is the meaningful perimeter in a cloud-first environment.
What security teams should do
Audit Azure Entra directory read permissions for all accounts, including service accounts and guest users. The default permissions for member accounts in Entra allow broad directory enumeration. Restricting these to the minimum required is a configuration change, not a product purchase.
Enable conditional access policies with device compliance requirements. A credential used from an unmanaged device should not be able to enumerate your entire Entra directory. Trusted device requirements and compliant device conditions address this directly.
Monitor for bulk Graph API enumeration. Entra ID sign-in logs and Microsoft Defender for Cloud Apps can surface anomalous Graph API usage patterns, including large numbers of directory object reads in a short time window.
Check your credential exposure via commercial threat intelligence. Hudson Rock, SpyCloud, and similar platforms index info-stealer logs and can tell you whether your organization's credentials appear in criminal marketplaces before an attacker uses them.
Review service principal permissions. Service principals are often provisioned with Directory.Read.All or broader permissions during development and never scoped down. These accounts are not protected by MFA in most configurations and represent the highest-risk attack surface in most Azure tenants.
The durable lesson
The three things that enabled this campaign: purchasing stealer logs at scale, authenticated cloud API access without device compliance checks, and broad default directory permissions, have all been known problems for several years. The novelty is not the technique. The novelty is a threat actor who operationalized all three into a systematic, scalable campaign against large enterprises.
The defense is available now. None of it requires new tooling. It requires auditing what your Entra directory permissions actually are, and closing the gap between what your endpoint policy covers and what your cloud policy covers.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are working through Azure identity security posture or cloud access governance in your organization.