-
Hudson Rock says attackers used stolen credentials from infostealer malware to enter enterprise Microsoft cloud environments.
-
McDonald’s, Vodafone, Kyndryl and other major companies were reportedly among the affected organizations.
-
The claims are not yet independent proof of separate breaches at every named company, making the stolen-access trail the key finding.
A large-scale campaign is allegedly using stolen employee credentials to access Microsoft Azure environments and remove company data.
Cybersecurity firm Hudson Rock says the activity has exposed millions of enterprise records. The companies named in its research include McDonald’s, Vodafone and Kyndryl.
The campaign does not appear to rely on a new Azure security flaw. Instead, the attackers allegedly used credentials and other login data stolen from infected devices.
That distinction matters. Hackers do not need to breach a cloud computing system if they have access through authentication.
Stolen Credentials Appear to be the Entry Point
Infostealer software is malware developed for gathering crucial data from an infected computer. This may involve stealing saved passwords, cookies from browsers, authenticated sessions, and various other authentication data. The hackers can later sell that information to other criminals who use it for further attacks.
Microsoft has warned that modern infostealers can collect browser credentials, session data, cloud credentials and developer secrets. Stolen credentials can then lead to access to corporate cloud services. In the campaign reported by Hudson Rock, attackers allegedly took this process a step further.
After obtaining stolen credentials, they used legitimate authentication paths to enter enterprise Microsoft environments. They could then access information that the compromised accounts had permission to see.
This makes the activity different from a traditional attack that exploits a software bug. The cloud service may work as designed while an attacker abuses a legitimate account.
Millions of Records Reportedly Exposed
The scale of the reported activity is significant. Posts circulating on cybercrime forums claim that a threat actor using the name “TheHatman” has published corporate directory data from several large companies. The posts claim the information came directly from Azure tenants using compromised credentials.
One forum analysis estimated roughly 3.64 million records across nine reported corporate directory dumps. The claimed targets included Hexaware, Kyndryl, Wyndham, IHG, HCL, TCS, Vodafone, McDonald’s and Gap.
The same analysis said a sample linked to McDonald’s appeared to contain Microsoft Extra directory fields. However, such forum analysis does not independently prove how the data was obtained.
That is why the names should be treated carefully. There is currently no public evidence confirming that every organization named by researchers suffered a separate, verified corporate breach. The available evidence instead points to a broader campaign involving stolen identities and cloud access.
Azure Itself was not Necessarily Breached
It’s important not to confuse the reported activity with a compromise of Microsoft Azure as a platform.
The central issue is identity. Microsoft Entra ID, which was previously called Azure Active Directory, provides access control to many services hosted by Microsoft cloud. In case the attackers manage to acquire the credentials or the active tokens for authentication, they can sometimes function with the exact access as the original user.
Microsoft has documented similar cloud attacks in which attackers used compromised identities to search company directories, access cloud resources and collect sensitive information.
Microsoft also says stolen browser session cookies can allow attackers to reuse an already authenticated session. In some cases, this can let them avoid another password prompt or certain older forms of multi-factor authentication. That creates a major problem for companies that only focus on changing passwords.
The risks are heightened by phishing kits like Kali365, which target the legitimate Microsoft OAuth 2.0 device authorization flow to capture MFA-satisfied tokens without ever stealing a password or defeating the MFA challenge, as the victim completes authentication against Microsoft’s genuine login page.
Password Resets may not be Enough
A password reset is still important after a credential theft incident. But it may not remove every form of access.
Microsoft says administrators can revoke a user’s active sessions and refresh tokens through Entra ID. It also recommends disabling compromised accounts and devices when necessary.
Microsoft notes that access and session tokens can have different lifetimes. Some existing sessions may remain active until their tokens expire unless the application or security controls revoke them sooner. This means organizations investigating an infostealer infection should look beyond the infected computer.
Security teams should review Entra sign-in records, identify unusual logins and check for unexpected access to company data. They should also revoke active sessions, rotate exposed credentials and examine authentication tokens.
Microsoft recommends using tools such as Continuous Access Evaluation and Defender capabilities to help detect suspicious token use and respond faster.
The Bigger Warning for Enterprises
The reported Azure campaign shows why infostealers remain a serious business threat. A stolen password may have little value if the user quickly changes it. The stealing of a session token is potentially more hazardous since it may allow access without even needing the password.
The exploit chain is quite straightforward: compromise an employee’s machine, steal the credentials, gain access to the cloud-based account using the credentials and loot anything that the account can access.
That makes endpoint security and cloud security closely linked. For companies whose names appeared in the Hudson Rock research, there’s a need for further investigation to determine what data the attackers accessed, when access occurred, and whether the claims reflect actual unauthorized access.
For other organizations, the lesson is already clear. Treat an infostealer infection as a possible cloud identity incident, not just a malware problem on one employee’s computer.
The reported campaign is therefore less about a new Azure flaw. It’s more about an old security weakness with a powerful new target: Trusted identities that already have the keys to the cloud.
