A Criminal Is Selling 3.6 Million Records Stolen From McDonald's and Eight Other Fortune 500 Firms, a Patched Mac Flaw Is Already Rooting Exposed Machines, and One APT Ran Espionage and Crypto Fraud From the Same Dashboard

Nine companies, 3.6 million records, one seller. A threat actor going by "TheHatman" has spent the past week flooding cybercrime forums with internal employee directories allegedly pulled straight from the Azure and Entra tenants of McDonald's, Tata Consultancy Services, Vodafone, HCL Technologies, Kyndryl, Gap Inc., InterContinental Hotels Group, Hexaware Technologies, and Wyndham Hotels. McDonald's tops the list at more than 1.7 million records, TCS follows at roughly 800,000, Vodafone at about 425,000. The data itself is the boring kind that does the most damage: full names, employee IDs, email addresses, job titles, phone numbers, physical addresses, reporting lines, and in some cases service accounts. None of the named companies have confirmed a breach. TCS says the data it's seen looks to be at least four years old and that its current controls remain effective. That's a real, meaningful distinction — old data recirculating isn't the same story as a live compromise — but it doesn't make the data any less useful to a criminal running phishing or business email compromise, and it doesn't explain how a four-year-old internal directory ended up on a forum this week regardless.

Hudson Rock's read on the mechanism is the more useful part of this story. Researchers there traced compromised Azure credentials tied to infostealer infections to employees at TCS, Gap, HCL, and Kyndryl specifically — including one compromised device that reportedly contained dozens of corporate credentials and hundreds of live session cookies, among them direct access to a Kyndryl Azure Active Directory account. That's not a platform vulnerability. It's the same story that keeps not getting old: a piece of infostealer malware lands on one employee's machine, harvests whatever credentials and session cookies happen to be sitting in the browser at that moment, and months or years later those cookies are still valid and still worth something to whoever bought them. The fact that only massive multinationals show up in this particular campaign, rather than a broad cross-section of smaller businesses, points toward deliberate targeting of already-stolen credentials rather than a scattershot Azure-wide exploit. If your organization runs on Microsoft 365 or Azure AD, the actionable move here isn't "audit your Azure configuration" — it's auditing whether any of your employees' machines have shown up in infostealer logs on the dark web, and rotating session tokens for anyone who has, since a stolen session cookie doesn't care how strong the underlying password is.

The second story starts with a patch that should have closed the door and didn't close it fast enough. Apple shipped an out-of-band fix on August 6 for CVE-2026-65400, an authentication bypass in macOS's Screen Sharing service — the built-in VNC-based remote desktop feature that listens on port 5900. The bug lets a remote attacker on the network authenticate to Screen Sharing without valid credentials at all, a failure Apple attributed to "improved state management," typically security-advisory shorthand for a broken authentication-flow or session-validation check. The Dutch National Cyber Security Centre flagged the flaw the day after Apple's patch, then updated its advisory on August 12 to confirm active exploitation: on every reported case where port 5900 was reachable from the internet, attackers obtained root access and installed a Monero cryptominer. Monero specifically, because unlike Bitcoin it doesn't require specialized mining hardware — any exposed CPU or GPU will do, which makes a fleet of unattended, internet-facing Macs a genuinely attractive target rather than a curiosity.

What makes this one worth remembering past this week is the severity rewrite. CISA's own scoring for CVE-2026-65400 started at 7.1 on August 6, built on the assumption that an attacker needed some baseline privilege and could only achieve partial impact. On August 14, that assessment flipped entirely: the agency replaced the scoring vector with one assuming no privileges required and full compromise of confidentiality, integrity, and availability, pushing the score to a maximum 9.8. A day after that, CISA's own decision record changed from "not automatable" to automatable — a formal acknowledgment that this is exactly the kind of bug that gets scripted and run against every exposed IP on the internet, not manually exploited one target at a time. As of this writing the flaw still isn't in CISA's Known Exploited Vulnerabilities catalog despite the NCSC's confirmed exploitation, which is its own reminder that KEV listing lags real-world attack activity rather than leading it — don't wait for a KEV entry to treat active exploitation as active exploitation. If Screen Sharing is enabled on any Mac your organization manages and it's reachable from outside your network, patch to Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 today, or disable Screen Sharing entirely if patching has to wait.

There's a sharper edge to this story too. AI security firm Calif said it built a working exploit for the underlying flaw class in four hours using an AI coding agent, and specifically cited that speed as its reason for withholding further technical detail until patch adoption improves. Whether or not you find four hours surprising, the pattern behind it should be familiar by now, because it's the same one that showed up in this week's earlier stories on SharePoint and SAP Commerce Cloud: the distance between a vendor's patch notes and a working exploit keeps shrinking, and AI-assisted reverse engineering of patches is becoming a normal part of how that distance shrinks. Treating "we shipped a patch" as equivalent to "the risk is handled" was already a dangerous assumption before AI-accelerated exploit development; it's a worse one now.

Third: a China-linked hack-for-hire group called Jewelbug, also tracked as Earth Alux, REF7707, and Ink Dragon, gave Symantec's Threat Hunter Team a genuinely unusual finding when the company published its investigation on August 13. Jewelbug runs two operations that look, on paper, like they'd belong to entirely different threat actors — state-aligned espionage against governments and militaries across the Middle East, Southeast Asia, and South Asia, and a for-profit cryptocurrency fraud scheme targeting Chinese-speaking users — and Symantec found both are run by the same small team, on the same shared infrastructure, from a single control panel called XG-Web. In one documented operation, Jewelbug compromised webmail accounts across 15 separate government tenants in the Middle East in a single move, by gaining write access to a shared telecom-hosting platform and injecting a malicious script into a template used across every tenant on that platform — turning one compromised host into simultaneous access across 15 ministries. The group's crypto-fraud arm runs a malicious browser extension with a clipboard-hijacking module that silently swaps a copied cryptocurrency wallet address for one the attackers control the instant it's pasted into a transaction, alongside SEO poisoning to push fake exchange sites to the top of search results.

The operational lesson here matters more than the geopolitical attribution. A single compromised shared-hosting platform, used by multiple separate government tenants, became the entry point for all of them at once — the failure wasn't in any individual ministry's security, it was in the shared infrastructure none of them controlled directly. If your organization's email, portal, or webmail runs on infrastructure shared with other tenants you don't manage, the security of that shared platform is now effectively part of your own attack surface, whether or not it shows up on your own risk register.

Three stories, three different mechanisms, one repeating shape: a stolen session cookie that outlives the employee who lost it, a patch that shipped eight days before exploitation caught up to it, and a shared platform that turned one compromise into fifteen. None of these required a novel technique. They required exactly the amount of patience attackers have clearly decided is worth spending — on old data, on the week between patch and adoption, and on infrastructure nobody was individually responsible for watching.