Cybersecurity

An alleged campaign linked to TheHatman is reportedly offering Azure/Entra ID directory dumps containing huge numbers of employee records, including a claimed 1.7M+ records from McDonald’s and 800K+ from TCS.

Stolen credentials, session tokens and overprivileged APIs can potentially give attackers access to entire corporate directories.

The leaked data reportedly includes employee identities, job titles, departments, reporting relationships, service accounts and privileged account information, creating a powerful roadmap for phishing, BEC and more.

A suspected China-nexus actor reportedly exploited CVE-2026-59310 only 5 days after disclosure, compromising an estimated 361 IPs across 47 countries.

The attack chain reportedly went from:

vCenter → Root Access → Credential Theft → ESXi → Babuk-derived ransomware

The interesting part is how the attackers turned a vCenter compromise into control of the underlying virtualization infrastructure.

I broke down the full attack chain, persistence mechanisms, credential harvesting, ESXi lateral movement, and ransomware deployment.

cross-posted from: https://lemmy.world/post/50742926

SafePal has disclosed a data breach affecting 39,798 customers. An order-tracking authorization flaw exposed names, emails, phone numbers, shipping addresses and purchase details. SafePal says private keys, seed phrases and wallet passwords were not exposed. The bigger risk now is targeted crypto phishing using the leaked customer information.

Apple has issued Threat Notifications to iPhone users across 110 countries, warning that they may have been specifically targeted by mercenary spyware. Apple has not attributed this wave to Pegasus, NSO Group, or any specific threat actor. I break down what the warning means, how advanced iPhone spyware and zero-click exploit chains work, and what affected users should do.