Act
active
TheHatman Claims Mass Credential Theft from Microsoft Entra Tenants
- Engineer — Plan: Organizations running Microsoft Entra are directly in scope for this credential theft campaign; review MFA coverage and conditional access policies, audit Entra sign-in logs for anomalous authentication, and apply Unit 42’s hardening guidance this sprint.
- SOC/IR — Act: An active claimed credential-theft campaign targeting Entra tenants creates an immediate hunt requirement — sweep Entra/M365 sign-in logs for impossible travel, anomalous service principal usage, and bulk authentication failures since mid-August when the campaign surfaced.
- Leader — Act: If the organization uses Microsoft Entra, direct the security team this week to confirm whether anomalous authentication activity is present and request a status brief; prepare talking points for leadership in case credential exposure is confirmed.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.