Unit 42

@unit42_intel · Twitter · 2026-08-17 22:15 UTC

Threat actor theHatman is selling corporate data allegedly exfiltrated from Microsoft Entra tenants. Unit 42 hasn't verified the specific intrusion vector, but we advise using mitigations appropriate to credential attacks, as outlined here: https://bit.ly/3RWfERf