[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fN6ZIGRz6Hl0xZKaeD0LBsZxu7xek27OP_d6R7Qvbg4o":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"b3abfe80-97b3-4225-8860-7e8ac93c9dc9","default-passwords-on-service-accounts-fuel-microsoft-365-compromise","7f55c809-6ba4-4238-91ec-877f6cdcb7dc","Default Passwords on Service Accounts Fuel Microsoft 365 Compromise","Seven Microsoft 365 service accounts were compromised because they retained default or never-rotated passwords, giving attackers an easy foothold through the TeamFiltration credential-testing framework. Non-human identities (service accounts, shared mailboxes, automation accounts) are frequently overlooked in password hygiene programs, creating a silent exposure gap. The campaign affected over 5,700 accounts across 28 tenants, demonstrating how a single misconfiguration can cascade into broad organizational risk. This matters because unmanaged service accounts often hold elevated privileges and are rarely monitored for anomalous sign-in activity.","**Immediate actions:**\n- Audit all service and shared accounts in Microsoft 365 and force an immediate password reset on any account using default, weak, or unrotated credentials.\n- Enable Multi-Factor Authentication (MFA) or certificate-based authentication for every account, including non-human identities, where technically feasible.\n- Block legacy authentication protocols (IMAP, POP3, SMTP AUTH) across all tenants to eliminate the vectors commonly exploited by TeamFiltration.\n\n**Long-term improvements:**\n- Establish a formal Non-Human Identity (NHI) lifecycle policy that mandates unique, complex passwords, regular rotation schedules, and periodic access reviews for all service accounts.\n- Implement Privileged Identity Management (PIM) or equivalent just-in-time access controls to limit the standing permissions of service accounts.\n- Maintain a continuously updated inventory of all managed and unmanaged Microsoft 365 accounts, flagging any without MFA or with stale credentials.\n\n**Detection measures:**\n- Deploy Microsoft Entra ID (Azure AD) sign-in risk policies and alerts to detect password-spray and enumeration patterns consistent with TeamFiltration activity.\n- Configure SIEM rules to alert on high-volume failed authentication attempts and successful logins from anomalous geographies or IP ranges.\n- Enable Unified Audit Logging across all Microsoft 365 tenants and route logs to a centralized platform with a minimum 90-day retention period.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-53 AU-2 (Event Logging)","NIST SP 800-63B – Digital Identity Guidelines (Password Requirements)","MITRE ATT&CK T1110.001 – Brute Force: Password Guessing","MITRE ATT&CK T1078.004 – Valid Accounts: Cloud Accounts","GDPR Article 32 – Security of Processing (appropriate technical measures)","ISO\u002FIEC 27001:2022 A.5.16 – Identity Management","ISO\u002FIEC 27001:2022 A.8.5 – Secure Authentication",{},"published","2026-09-24T10:21:45.208733+00:00","2026-09-24T10:21:44.924+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fteamfiltration-compromises-seven.html","teamfiltration-campaign-compromises-seven-microsoft-365-accounts-using-default-p-b54ca6","TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[53,57,61],{"slug":54,"name":55,"problem":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":58,"name":59,"problem":60},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":62,"name":63,"problem":64},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed."]