TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords
TeamFiltration campaign targets Microsoft 365 accounts using default passwords.
A TeamFiltration campaign, codenamed UNK_CondorFiltration, has targeted over 5,700 Microsoft 365 accounts across 28 tenants, primarily focusing on Chilean financial and retail institutions. The campaign successfully compromised seven unmanaged service accounts by exploiting default or unrotated passwords, highlighting a significant exposure gap for non-human identities. The threat actor utilized the TeamFiltration framework to enumerate accounts, test credentials, and potentially exfiltrate data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Proofpoint?
Get an email when a new story names Proofpoint, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonSeven Microsoft 365 service accounts were compromised because they retained default or never-rotated passwords, giving attackers an easy foothold through the TeamFiltration credential-testing framework. Non-human identities (service accounts, shared mailboxes, automation accounts) are frequently overlooked in password hygiene programs, creating a silent exposure gap. The campaign affected over 5,700 accounts across 28 tenants, demonstrating how a single misconfiguration can cascade into broad organizational risk. This matters because unmanaged service accounts often hold elevated privileges and are rarely monitored for anomalous sign-in activity.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — TeamFiltration