August 17, 2026
- theHatman selling ~3.6M Azure/Entra records from Fortune 500 tenants. The actor claims to have exfiltrated employee and identity databases after gaining access via compromised credentials; Unit 42 hasn't verified the intrusion vector but recommends credential-attack mitigations, warning of downstream social engineering (BleepingComputer, SecurityWeek). · Cloud & Identity
in One Video Call to Kernel: Unisoc Baseband Chain Gives Full Android Takeover