The IT Nerd

A threat actor has flooded the underground forums with datasets for sale, allegedly stolen from the Microsoft Azure and Entra cloud environments of some of the world’s largest companies, exposing information that could help criminals target employees.

The attacker, going under the alias “TheHatman,” has posted data linked to at least 9 major enterprises on underground forums over the past week:

• McDonald’s Corporation: 1,700,000 records
• TCS (Tata Consultancy Services): 800,000 records
• Vodafone: 425,000 records
• HCL Technologies: 250,000 records
• InterContinental Hotels Group (IHG): 185,000 records
• Kyndryl: 170,000 records
• Gap Inc.: 80,000 records
• Hexaware Technologies: 20,000 records
• Wyndham Hotels: 9,000 records

To prove their claims, the attacker shared data samples. While the download link to McDonald’s data sample was not functional when Cybernews researchers checked, the other companies’ entries revealed what kinds of data may be included in the allegedly stolen datasets. The sample records across the listings include employee emails, phone numbers, job titles, full names, and workplace addresses.

“The impact for individuals is a heightened risk of social engineering attacks. Compromised credentials may be rotated by now, but in case it wasn’t it could be used for further data exfiltration,” said Cybernews researchers.

An attacker with accurate information about an organization’s employees, managers, departments, and reporting structures can construct highly convincing phishing messages. A criminal could, for example, impersonate an employee’s manager or an IT administrator and use real organizational details to make a request appear legitimate.

For more information, here’s the full article: https://cybernews.com/security/mcdonalds-vodafone-azure-microdoft-credential-theft/

UPDATE: Roman Sannikov, Global Research Coordinator, iCOUNTER Had This To Say:

“This isn’t a breach of Azure; it’s a breach of credential hygiene that happened to land on Azure tenants. TheHatman didn’t need to touch a vulnerability; infostealer malware harvested valid logins, and from there it’s a straight walk into the Entra directory. What should worry defenders more than the record counts is what’s actually in the data: service account names and global admin identities. That’s more of a target list than a list of victims. Hudson Rock called it a roadmap for social engineering, and they’re right: an attacker no longer has to guess who holds privileged access at McDonald’s or Vodafone; they have the org chart handed to them. The operational question for any threat intel team right now isn’t ‘were we on this list.’ It’s whether the same infostealer logs that fed this campaign already have your employees’ credentials sitting in a marketplace nobody’s checked yet.

There’s a second exposure most teams miss: any organization that does business with McDonald’s, TCS, Vodafone, HCL, or IHG should already be treating whatever data those companies hold on them as compromised and raising their security posture toward those specific relationships accordingly. This is exactly why knowing when your third parties are at risk of compromise, not just when you are, has to be part of the collection requirement. Once a threat actor is sitting inside an organization at this level, they have a direct pathway into every partner and vendor connected to it.”

UPDATE #2: Seemant Sehgal, Founder & CEO, BreachLock Had This To Say:

   “This is a reminder that the perimeter most organizations are defending is not where the adversary is operating. A valid credential, once stolen, moves through an environment the same way a legitimate user does. The attacker does not need to break anything. What makes this particularly significant is the nature of the data itself. Directory attributes, tenant structures, and employee identifiers are the raw materials for follow-on attacks, targeted phishing, or supply chain access. 

   “Security teams need to ask whether a credential that was exposed six months ago is still giving someone access to a cloud environment today. Perimeter controls can be strong and still leave that kind of access untouched. The organizations downstream from the initial compromise are often the ones who feel it most. The real test is understanding what an attacker could do with a compromised credential, where it could take them, and whether anyone would know it was being used.”

John Carberry, Solution Sleuth, Xcape, Inc.:

   “Exfiltrating internal directory structures and employee credentials across corporate cloud tenants creates an immediate risk of targeted spear phishing, business email compromise, and privilege escalation. The mass exposure of 3.64 million records from Fortune 500 Microsoft Azure environments highlights a widespread failure in identity boundary enforcement rather than a cloud platform vulnerability. Organizations must continuously audit user account activity, paying special attention to accounts with elevated privileges, to detect anomalous directory enumeration or session hijacking.

   “Given that Azure tenant attributes, active domains, and service account details were exfiltrated, affected companies should immediately rotate credential stores, reset application registration secrets, audit service principal permissions, and review federated domain trust relationships. Security leaders must mandate phishing-resistant multi-factor authentication, restrict tenant export rights, and monitor endpoint infostealer logs to stop credential theft before attackers map internal cloud architecture.

   “Critical Takeaways:

• Identity perimeter failure: The exposure stems from compromised credentials and infostealer malware, not a zero-day flaw in Microsoft Azure infrastructure.
• Tenant remediation: Affected organizations must reset application secrets, audit service principal privileges, and review federated trust relationships immediately.
• Privileged account auditing: Security teams must enforce strict conditional access and audit user accounts with elevated privileges to intercept active session abuse.

   “Blaming the cloud provider for stolen credentials is like blaming the lock manufacturer when you leave your house key under the doormat.”

Following a report of a fake Wi-Fi network on a Delta flight to Atlanta, Cybernews’ Senior Information Security Researcher Aras Nazarovas has commented on the risks such networks may pose, as well as what the people affected should know. 

What risks do fake Wi-Fi networks pose? What is an evil twin attack?

“An evil twin attack is when hackers create fake Wi-Fi networks with the goal of stealing sensitive information from people, or exploiting known vulnerabilities present on victim devices. The fake networks often have a very similar (or identical) name to the legitimate network, which was the case here.

Once a person connects to the hacker’s Wi-Fi network, the hacker may be able to see what the victim is doing online and what data they transfer. However, since most websites have HTTPS/TLS encryption, much of what the user does, even on the rogue network, is private.

The risk here is that the hacker may attempt to redirect the victim to a phishing website – for instance, in this case, it may have been a fake Delta login page asking for personal data like name, email, address, etc. Or, the hacker may even go further and provide fake login pages for banks, social media, and try to extract login details from the victims.”

Are the people who connected to the network at risk?

“Connecting to such a network comes with some risk in itself. Connecting to a network controlled by a threat actor allows them to probe your device for potential vulnerabilities and maliciously redirect your internet traffic to their own servers. 

If a person entered credentials into a Wi-Fi login page, noticed security warnings popping up after visiting a website, downloaded something, or entered payment information into an unfamiliar page, then they may have had their data stolen. In that case, the victim should immediately change any passwords that were transmitted, do a thorough scan of their device for malware, and if bank details were transmitted, freeze the bank account until new credentials are received.

However, if a user just connected and disconnected to the Wi-Fi without entering any details or clicking suspicious links, they should be fine.”

Cybernews researchers discovered an unprotected Talentsconnect database with nearly 11GB of live recruitment data, referencing 843 companies, including references associated with Siemens, Deutsche Bank, Vodafone, BASF, and EY. Talentsconnect is a company that specializes in direct-to-talent (D2T) matching platforms, which connect job seekers and employers. 

Here are the key findings:

• The exposed database with over 5 million job listings included applicants’ names, emails, phone numbers, salary expectations, Base64-encoded CVs, or cover letters.
• The database showed 335 plaintext credentials across 56 client integrations. One belonged to the waste management company Remondis, with username and password information potentially providing access to their recruitment portal.
• Researchers found 80 plaintext credentials for FFG Prescreen, a background-check tool used in hiring. These are intended to allow candidates to modify submissions, but malicious actors could exploit them to post fake jobs, alter details, or delete data. 
• Exposed data contained AWS Secrets Manager references for such companies as Siemens, Vantage Towers (Vodafone), Hornbach, ARAG, Computacenter, Peek & Cloppenburg, and UniCredit.

“This is a single point of failure sitting behind the hiring pipelines of hundreds of major European employers. Anyone on the internet could have read the entire client roster, harvested candidate personal data, or, because access was read/write, altered or injected data. For example, posting fake job ads under real company names, submitting fraudulent applications with malicious attachments, or deleting listings,” our researchers explained.

Talentsconnect closed the database after researchers disclosed the issue to the company, and the information is no longer publicly accessible. Cybernews researchers found no evidence that unauthorized users accessed the data while it was still leaking. 

For more information, here’s the full report:

https://cybernews.com/security/talentsconnect-hr-database-data-leak

By Stefanie Schappert

Cyberattacks on water and wastewater systems have surfaced across at least 12 US states since July 26th.

The FBI and CISA are increasingly pointing to the CyberAv3ngers, an Iranian-linked threat group backed by the Islamic Revolutionary Guard Corps (IRGC).

And while fresh attacks are being reported daily by local municipalities across the country, the bigger question isn’t where or when the next strike takes place – it’s why America’s water infrastructure has become such an attractive target in the first place.

Water is the perfect target

Water occupies a unique place in America’s critical infrastructure. Every community depends on it, and unlike many other public services, there is no alternative if the systems providing it are compromised. 

And creating uncertainty around an essential public service can be just as valuable as causing the disruption itself. 

Attackers don’t have to poison a water supply or leave an entire city without service to achieve an effect. They just have to make people wonder:

• Is my drinking water safe?
• Could someone shut off my town’s water?
• How vulnerable is the infrastructure I rely on every day?

Even an unsuccessful attempt at disruption can shake public trust – and with headlines that stretch across the internet, the psychological effect can reverberate across an entire nation.

Built to be breached 

Over 50,000 drinking water and wastewater systems operate across the US, many serving small communities with limited cybersecurity resources and insecure technology. 

Many facilities still rely on internet-connected industrial control systems for remote management, creating a large and diverse attack surface.

CyberAv3ngers have found the perfect weakness in these systems: unpatchable PLC devices.

The programmable logic controller (PLC) is essentially an internet-facing computer used to automate facility operations, serving as one of the main components of SCADA systems across critical infrastructure. 

CyberAv3ngers – at first just a hacktivist group – began zeroing in on Unitronics PLC devices back in 2023, simply because its software was made in Israel.

By 2025, CyberAv3ngers had expanded to target the more commonly used Rockwell Automation PLCs, exploiting an authorization bypass vulnerability that can never be patched. 

Defenders have little recourse, while the FBI warns operators to proactively rely on defense-in-depth security measures in the absence of a permanent fix.

The water playbook evolves 

CyberAv3ngers first gained attention by defacing Israeli-made PLCs with pro-Iran messages before evolving into an IRGC-linked threat actor that developed its own strain of industrial malware, IOControl.

According to researchers, that malware has now been disseminated to at least 60 Iran-affiliated hacking groups, making threats against our water supply far less predictable. 

Instead of tracking one actor’s tactics, techniques, and procedures (TTPs), system defenders may be facing dozens of groups capable of utilizing the same underlying toolkit to modify and deploy new iterations of the malware. 

And that can leave security teams in the dark about what to look out for and how to harden systems against any one threat.   

Researchers have also documented the group’s recent use of AI tools – specifically ChatGPT – for code debugging and research, suggesting that CyberAv3ngers and its targeted malware could become even more sophisticated and stealthy as they continue to evolve. 

ABOUT THE EXPERT

Stefanie Schappert, a senior journalist at Cybernews, is an accomplished writer with an M.S. in cybersecurity, immersed in the security world since 2019.  She has a decade-plus experience in America’s #1 news market working for Fox News, Gannett, Blaze Media, Verizon Fios1, and NY1 News.  With a strong focus on national security, data breaches, trending threats, hacker groups, global issues, and women in tech, she is also a commentator for live panels, podcasts, radio, and TV. Earned the ISC2 Certified in Cybersecurity (CC) certification as part of the initial CC pilot program, participated in numerous Capture-the-Flag (CTF) competitions, and took 3rd place in Temple University’s International Social Engineering Pen Testing Competition, sponsored by Google.  Member of Women’s Society of Cyberjutsu (WSC), Upsilon Pi Epsilon (UPE) International Honor Society for Computing and Information Disciplines.

The Cybernews research team recently discovered a publicly accessible server running a major phishing operation impersonating the French bank Credit Agricole. After discovering the threat actor’s infrastructure, our team contacted Credit Agricole and the French CERT to inform the company and relevant authorities of the abuse.

Here’s what the investigation found:

• The phishing campaign had access to 149 stolen SendGrid API keys and three stolen AWS accounts, with a combined sending capacity of around 7,000 emails per day.
• The phishing panel’s database contained 912 victims who had entered their credentials into phishing forms, as well as 83 payments made to the scammers.
• Bank credentials were used only to obtain additional data on the victim. To scam people out of their money, cybercriminals called the victims and used social engineering techniques to trick them into paying for a fake service.
• The phishing panel contained a leaderboard for the phishing operators to compete against each other to see who could earn the most from their victims. The prize for the most successful scammer was €3,000. 

The findings underline a painfully obvious security problem: organizations continue to leave sensitive files exposed in internet-facing systems, unintentionally handing attackers the tools needed to operate fraud campaigns.

For more information, here’s the full report: 

https://cybernews.com/security/bizarre-credit-agricole-phishing-scam

Cybernews researchers uncovered an active ransomware campaign against multinational semiconductor company V-Silicon after discovering an exposed hacker server.

Here’s a timeline of the findings:

1. Cybernews researchers discovered an exposed web directory that functioned as a staging server for a ransomware attack.
2. A subsequent investigation linked the discovered infrastructure to an attack against V-Silicon, a multinational semiconductor company that develops chips used in smart TVs and display devices.
3. The campaign was attributed to INC Ransomware, a ransomware-as-a-service (RaaS) operation that has been active since 2023.
4. We alerted V-Silicon to the exposed data on July 17th. 
5. One day later, the INC ransomware group published V-Silicon on its leak site, claiming responsibility for the attack.

What was found on the internal hacker server?

• “The artifacts found on the exposed server indicate that during network enumeration, third-party infrastructure and data could have also been compromised”, Cybernews researchers explain.
• The ransomware was built to run on a wide range of computer systems, suggesting that the attackers may have intended to encrypt embedded controllers, industrial systems, or older semiconductor manufacturing equipment.
• Researchers noticed coding patterns that suggest some scripts may have been generated with AI.

For more information, here’s the full report: 

https://cybernews.com/security/hackers-exposed-ransomware-attack-v-silicon

Cybernews researchers have analyzed the KEV (Known Exploited Vulnerabilities) Catalog – a list of already-exploited weaknesses in software (or hardware), compiled by CISA (the U.S. Cybersecurity and Infrastructure Security Agency). Cybernews found 828 common vulnerabilities and exposures (CVEs) at AI companies since 2021, with Microsoft accounting for 377 of them.

Key findings:

• Since 2021, CISA has recorded 828 CVEs across 16 AI companies.
• Out of all AI companies in the dataset, Microsoft is by far the leader in the number of CVEs, with 377 vulnerabilities found.
• A closer look at Microsoft revealed that 27% of vulnerabilities were ransomware-related.
• Microsoft Windows is the most-exploited product, with 170 known vulnerabilities.

“The number of exploited vulnerabilities correlates strongly with a technology company’s market share. This isn’t surprising: the biggest products draw the most attacker attention, since a single vulnerability can be leveraged against a far larger user base. That said, the shift toward SaaS, the growing amount of business-critical data living online, and the rapid adoption of AI are all raising the stakes around trust and vendor reputation,” says Voldemaras Kadys, Head of Security and Platform Engineering at Mediatech, the digital publishing house behind Cybernews.

For more information, here’s the full report:

https://cybernews.com/security/828-vulnerabilities-exploited-at-ai-companies-since-2021

A threat actor has just listed a database allegedly containing 75 million records of Revolut customers on a cybercrime forum. The threat actor posted over 100 sample records. 

Cybernews researchers have investigated the dataset. Here’s what was included:

• Partial credit card data: last 4 card digits, card type, expiration dates, and card statuses (active, blocked, frozen, etc).
• User credentials: bcrypt or argon2id hashes, timestamps when the credentials were rotated.
• User personal data: emails, full names, phone numbers, resident countries, addresses, currency, registration IP address, and other account identifiers
• Other sensitive data: including device models, operational systems, and timestamps.

Cybernews has reached out to Revolut for comment. The company’s spokesperson said they are aware of the claims. However, they “see no indications of any breach.”

Cybernews researchers could not verify the claimed number of records and remain skeptical about the claimed scope of the dataset. If the dataset really contains 75 million records, the $500 price tag advertised on the illicit marketplace is unusually low for a leak of that size.

If the claims prove to be legitimate, the exposed information could pose serious risks. “Affected individuals may be at risk of social engineering attacks and identity profiling. Attackers may also attempt to gather full payment method information,” Cybernews researchers warned.

For more information, here’s the full report: https://cybernews.com/security/revolut-data-breach-75-million-records/

For the first time since 2013, a documentary crew got access inside DEF CON, the world’s largest and most secretive hacker conference held annually in Las Vegas. The film features exclusive interviews with senior DEF CON figures, Black Badge winners, and even DARPA officials. The documentary will premiere on Cybernews’ YouTube channel on August 3rd.

This film explores how the past decade has changed not only public perception of hacker culture, but the community itself. As the line between hacking and defence has blurred, DEF CON now attracts everyone from teenagers to cybersecurity professionals to government agencies. 

Using personal archives from the community’s original creators and exclusive behind-the-scenes access, the documentary looks back at DEF CON’s early days and shows how far the community has come.

A promise to tell the truth

DEF CON has strict filming rules, and most previous coverage has rarely gone beyond vlogger-style footage. The Cybernews crew got exclusive sit-down interviews and tells the story of how the conference has changed from a small gathering into an event that now includes even government-organized competitions, including efforts to hack Air Force satellites.

‘Hacker’ through the eyes of the community

The community has long been followed by the myth that hackers are criminals. According to Moss, that perception dates back to the early 1990s, when reporters were trying to explain a new type of crime involving computers.

More than a decade of change: from parties to the US Air Force

Looking at DEF CON’s history, what used to be an old-school, underground hacker gathering with pranks and partying has evolved into something far broader. Today, it attracts professional coders, young people building careers in cybersecurity, and government officials. DARPA has held competitions at the conference, including the Cyber Grand Challenge and the more recent AI Cyber Challenge. 

When the US Air Force wanted more people to develop the skills needed to evaluate satellite security, it created the Hack-a-Sat competition at DEF CON and, in its final year, launched a satellite just for competing teams to attack.

The documentary will be publicly available on Cybernews’ YouTube channel starting August 3.

Cybernews researchers uncovered an exposed server belonging to a threat actor that contained documentation of attacks against accommodation-sector companies, source code, hacking tool configurations, and stolen booking data.

Key findings:

• Researchers found at least 50 penetration test reports targeting accommodation companies.
• Researchers say the hacker bypassed LLM guardrails by disguising malicious intent as penetration testing.
• The attacker used HexStrike AI, an open-source tool that integrates large language models (LLMs), together with Anthropic’s Claude.
• The exposed server contained stolen booking-related data, including guests’ personally identifiable information (PII) such as names, emails and phone numbers.
• Researchers observed 2.1 million unique email addresses in exported files, which most likely correlated to the number of exposed individuals.
• The attacker took the server out of public view during the investigation, but the Cybernews team managed to identify at least 4 affected companies, including a Canadian one.

The leaked data included records from IGMS, a Canadian company that specializes in Property Management Software (PMS) development. Extracted data included host phone numbers, check-in and check-out dates, host emails, property address, and, in some cases, WiFi passwords. Researchers observed 1,400 records from IGMS.

The researchers warn that stolen reservation data can be used in highly convincing phishing campaigns, especially when attackers know guests’ names, travel dates, and reservation details.

For more information, here’s the full research: https://cybernews.com/security/claude-ai-exploited-breach-hotel-booking-platforms