[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_wsjmt3V85EkFmZB6f164Js3cbxcAuQmgioOATLSoR4":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"2a018a8e-b3b9-4d88-8abe-65e826770812","Ghost Service Accounts Enable M365 Data Theft in Chile","ghost-service-accounts-enable-m365-data-theft-in-chile-75c374","Even if the organization locks down employee accounts, forgotten and lost service accounts can still undo the organization's entire M365 environment.","A security analysis has revealed that compromised Microsoft 365 environments in Chile are vulnerable to data theft through forgotten or lost service accounts. These accounts, often overlooked during security audits and employee offboarding, can retain access to sensitive data even when active user accounts are secured. This oversight allows threat actors to potentially exfiltrate large amounts of data by leveraging these persistent, ghost service accounts.","Forgotten M365 service accounts in Chile enable data theft even after employee account lockdowns.","https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Fghost-service-accounts-m365-data-theft-chile","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt616fa081889caa0c\u002F6ab405d757365f201ef41265\u002FChile-Gwengoat-Getty.jpg?width=720&quality=80&disable=upscale","2026-09-24T13:30:00+00:00","2026-09-24T14:00:15.946858+00:00",7,[17,20],{"name":18,"type":19},"M365","product",{"name":21,"type":22},"service accounts","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":23,"icon":25,"name":26,"slug":27},null,"Breaches","breaches",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":49,"vendors":133},[50,79,107],{"slug":51,"name":52,"problem":53,"products":54},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":80,"name":81,"problem":82,"products":83},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[84,92,99],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":94,"url":97,"description":98},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":108,"name":109,"problem":110,"products":111},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[112,120,125],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":121,"product_name":122,"url":123,"description":124},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",[134],{"slug":64,"name":65,"logo_path":66,"roles":135},[136],"affected",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":151},"ghost-service-accounts-expose-m365-environments-to-data-theft","Ghost Service Accounts Expose M365 Environments to Data Theft","The root cause of this threat is the failure to properly manage and decommission service accounts throughout their lifecycle, leaving 'ghost' accounts with persistent access to sensitive Microsoft 365 data long after they are needed. Unlike human user accounts, service accounts are frequently excluded from standard offboarding and audit processes, creating invisible attack surfaces that threat actors can exploit. This matters because a single overlooked service account can grant broad access to organizational data, bypassing all user-level security controls that have been carefully implemented. The Chile incidents demonstrate that identity hygiene is not just about active employees — every privileged identity, human or non-human, must be continuously governed.",[142,143,144,145,146,147,148,149,150],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 AC-6 (Least Privilege)","NIST SP 800-53 IA-4 (Identifier Management)","NIST CSF PR.AC-1 (Identities and credentials are managed)","ISO\u002FIEC 27001 A.9.2 – User Access Management","GDPR Article 32 – Security of Processing (access control obligations)","MITRE ATT&CK T1078.004 – Valid Accounts: Cloud Accounts",{"CIS Control 5 – Account Management":152,"NIST SP 800-53 AC-6 (Least Privilege)":153,"NIST SP 800-53 AC-2 (Account Management)":154,"CIS Control 6 – Access Control Management":155,"NIST SP 800-53 IA-4 (Identifier Management)":156,"ISO\u002FIEC 27001 A.9.2 – User Access Management":157,"MITRE ATT&CK T1078.004 – Valid Accounts: Cloud Accounts":158,"NIST CSF PR.AC-1 (Identities and credentials are managed)":159,"GDPR Article 32 – Security of Processing (access control obligations)":160},"Account management means inventorying and disabling service accounts when no longer needed, preventing ghost accounts in M365.","Least privilege limits what ghost service accounts can reach, reducing the impact if one is abused.","Account management includes regular reviews and removal of unused accounts, covering service accounts often missed in offboarding.","Access control management ensures service accounts have only the access they need and are reviewed regularly.","Managing identifiers through their lifecycle ensures service account identities are retired when their purpose ends.","User access management covers provisioning, review and removal, which must include non-human service accounts.","Attackers use valid cloud accounts, so ghost service accounts with standing M365 access are attractive targets for abuse.","Managing identities and credentials includes service accounts, so ghost accounts are not left with standing access.","Appropriate access control measures are required to protect personal data in M365, including controlling service account access."]