www.it-connect.fr
TeamFiltration: 7 Microsoft 365 Accounts Compromised, All Forgotten Service Accounts
5,714 Microsoft 365 accounts targeted, 7 compromised... and none belonged to an employee. They were all forgotten service accounts protected by a simple password and no MFA. Here's what to take away from the UNK_CondorFiltration campaign.
On September 22, 2026, Proofpoint researchers published a report on a campaign targeting Microsoft 365 tenants using the password spraying technique. In this campaign, the attacker relied on TeamFiltration, an offensive framework created by Joakim Kandefelt (TrustedSec) for penetration testing Microsoft 365 environments. In practice, this tool can enumerate accounts via the Teams API, test passwords against those accounts, and then, if successful, exfiltrate emails, Teams conversations, and OneDrive files.
On paper, it is a tool intended for auditors to perform Red Team exercises. However, like other tools, it has been repurposed, and this is far from the first time. In June 2025, I published an article about the UNK_SneakyStrike campaign, which had targeted more than 80,000 Microsoft Entra ID accounts with TeamFiltration. Once again, the tool was identified thanks to its hard-coded user agent: that of a desktop Teams client from 2020 (version 1.3.00.30866), which is no longer commonly seen in legitimate traffic.
More than 32,000 authentication attempts
Across the campaign, Proofpoint counted 32,825 authentication attempts against 5,714 accounts spread across 28 Microsoft 365 tenants. All of these attempts came from a cluster of IP addresses containing 1,487 IPs, all associated with AWS EC2 instances.
Proofpoint researchers also identified three successive waves. As you will see, Chile is the country targeted by this campaign:
- July 21 to 24: about 100 to 120 accounts targeted per day, mainly at two major Chilean banks.
- July 26 to 28: a peak of about 1,520 accounts on July 27, targeting another major Chilean financial institution.
- August 13 to 16: a peak of about 1,560 accounts on August 15, this time against a major Chilean retailer.
That retailer is actually the main target, as it accounts for 78.3% of the observed events on its own. More importantly, it was on this Chilean retailer's tenant that the attacker managed to compromise 7 Microsoft 365 accounts. All of this in less than 10 minutes.
According to Proofpoint, this timeframe strongly suggests "a shared or default password set, consistent with an organizational provisioning process, rather than account-by-account credential stuffing".
Beyond the potential data exfiltration, less than 90 seconds after the compromise, the attacker attempted to pivot to a VPN node located in Germany to connect to the company's VPN. The attempt was blocked by a security mechanism (MFA or conditional access).
Accounts that belong to no one
What is interesting about this campaign is the nature of the compromised accounts: these were not user accounts. They were service accounts, as Proofpoint explains: "These accounts were not used by humans. They were created to run business operations (ticket management, supplier payment approvals, point-of-sale operations, request processing), then left behind, still active in the tenant directory, but belonging to no one."
A forgotten and poorly protected account is a weak link. It is proof that an organization is not always compromised through an employee falling victim to phishing or through the exploitation of a zero-day flaw. This article is an opportunity to highlight a few actions you can take on your side:
- Inventory: identify in Entra ID accounts with no recent interactive sign-in, especially those not tied to any person.
- Passwords: disable what is no longer needed, and replace any default password with a unique, strong one. The basics.
- Conditional access: restrict these accounts to the applications and locations they actually need, and enforce MFA wherever possible (although this is not simple for service accounts).
- Detection: search Entra ID sign-in logs for the Teams/1.3.00.30866 user agent, as well as the IP ranges published by Proofpoint in its report.
And you: do you know how many service accounts are sleeping in your tenant, still using the password that was set the day they were created?
