A password-spraying campaign across 5,700 accounts found its way in through seven service accounts on default passwords
Proofpoint tracked a TeamFiltration campaign against 28 Microsoft 365 tenants in Chile. It sprayed more than 5,700 accounts and compromised seven, every one an unmanaged functional or service account on a default or unrotated password with no MFA.
Proofpoint detailed a campaign it tracks as UNK_CondorFiltration that used TeamFiltration, an open-source framework for enumerating, spraying and backdooring Entra ID accounts, against more than 5,700 accounts in 28 Microsoft 365 tenants, mostly Chilean retail and financial organizations. It ran in three waves between July 21 and August 16, from 1,487 AWS EC2 addresses, peaking at about 1,560 accounts in a day. Seven accounts were compromised. All seven were unmanaged functional or service accounts, not employee accounts, and all used default or unrotated passwords with no MFA. Within two minutes of access the attacker switched to a VPN node in Germany, opened Office, OneDrive and Teams, probed the corporate VPN, Azure Portal and SharePoint Online, and began requesting Microsoft Graph tokens. TeamFiltration was also behind a 2025 campaign that targeted more than 80,000 accounts.
Why it matters
Password spraying is supposed to be a solved problem in a tenant with MFA everywhere. This campaign shows where "everywhere" stops: shared mailboxes, kiosk logins, integration accounts and other identities no single person owns, which keep the password they were created with and are exempted from MFA because nobody is there to answer the prompt. Out of 5,700 accounts tried, those were the only ones that opened.
The fix is an inventory question more than a technology one. List every account in Entra ID that can sign in interactively but has no named owner, then decide for each whether it needs to sign in at all. Most functional accounts do not, and Conditional Access can block interactive sign-in for them outright; the ones that do need an owner, a rotated password and a phishing-resistant method. The fast pivot to Graph token requests is the detection opportunity: a functional account asking for new tokens from a new network is rarely legitimate. See password spraying and service accounts.
Source: The Hacker News
Related on Start with Identity
- BlogHuntress tracks stolen-session replay into 79 Microsoft 365 organizations without a password
Huntress reported on October 22 that one actor replayed tokens stolen by AiTM and device-code phishing into 79 organizations between July 14 and September 22, r
- BlogMicrosoft: fake Teams help desk calls led to AD CS certificates for privileged accounts and a domain controller
Microsoft investigated two intrusions that began with attackers posing as IT support on Teams and ended with Active Directory Certificate Services abuse. ESC1 y
- BlogOne ConnectWise app credential opened Microsoft 365 tenants across MSP customers
Huntress found an attacker signing in as the ConnectWise Cloud Backup (formerly SkyKick) Entra app with a stolen app credential, pulling Microsoft Graph tokens
- CVEWindows Kerberos KDC hands out RC4 service tickets for Kerberoasting
Domain controllers issued RC4-encrypted service tickets to accounts with no explicit encryption setting, which an attacker can crack offline for the service acc
- CVEFortinet administrative FortiCloud SSO authentication bypass across accounts
An attacker with their own FortiCloud account and registered device could log in as admin to other customers' Fortinet devices with FortiCloud SSO enabled. CWE-
- GuideKubernetes Identity and Security Guide: RBAC, Service Accounts, and Pod Identity
Secure Kubernetes workloads with proper RBAC configuration, service account hardening, OIDC integration, pod identity, and secrets management best practices.