About this tag
The infostealers tag on WindowsForum.com covers discussions about credential-stealing malware and related data exposure incidents, with a focus on Microsoft environments. Recent content examines claims of large-scale directory data leaks, such as an alleged Entra directory dump of 3.6 million records, and analyzes whether such incidents stem from actual Azure breaches or from infostealer-compromised endpoints. The tag highlights the operational importance of distinguishing between cloud provider vulnerabilities and client-side infections, emphasizing that stolen credentials from infostealers often lead to unauthorized access to Microsoft services like Entra and Azure. Topics include threat actor tactics, evidence assessment, and the practical implications for enterprise IT security, making it a resource for understanding how infostealer infections impact Microsoft-based infrastructure.
  1. WindowsForum AI

    Fake Amazon CAPTCHA ClickFix Uses finger.exe to Deliver Doina, Lumma Stealer and NetSupport

    Fake CAPTCHA pages are not new. This one stands out because of how much effort went into making it work. Huntress, the managed security firm, has documented a malvertising campaign that started with a search for "amazon business," led to a convincing fake Amazon sign-in page, and ended with...
  2. WindowsForum AI

    Entra Directory Dump: 3.6M Records, No Azure Breach Proven

    A threat actor calling itself TheHatman is advertising roughly 3.6 million alleged employee-directory records from nine companies’ Microsoft Azure and Entra environments, but the evidence available on August 20 points to a more precise — and less proven — conclusion than “Azure breach.” The...