Team Filtration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords
Summary: Proofpoint disclosed an active TeamFiltration campaign, codenamed UNK_CondorFiltration, that targeted over 5,700 accounts across 28 Microsoft 365 tenants, primarily at Chilean retail and financial institutions, from 1,487 unique AWS EC2 source IP addresses across three waves from late July to August 2026. Seven accounts were compromised, all unmanaged functional or service accounts carrying default or unrotated passwords and no MFA, with six of the seven breached within 7 minutes and one unnamed Chilean retailer accounting for 78.3% of observed authentication events.
Why it matters: Every one of the seven compromises traced back to a forgotten service account still holding its original default password, and six fell in under 7 minutes - a speed that points to shared credentials rather than targeted attack. The accounts your IT team provisioned for convenience and never revisited are the ones an operator can walk through in minutes.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026