Reported by 2 outlets
TeamFiltration Hackers Target 5,700 Microsoft 365 Accounts to Exploit Forgotten Service Accounts
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
Proofpoint tracked a password-spraying campaign named UNK_CondorFiltration that targeted over 5,700 Microsoft 365 accounts across 28 tenants. The campaign breached seven forgotten service accounts that lacked multi-factor authentication. The attackers focused heavily on Chilean retail and financial organizations and abused the TeamFiltration offensive framework, originally built for legitimate Microsoft 365 testing.
No CVEs are assigned; the risk is operational rather than a software vulnerability. The event content confirms concrete numbers: 5,700 accounts, 28 tenants, 7 breached service accounts, and geographic targeting of Chilean organizations. The framework's dual-use nature shows how legitimate security tools can be repurposed for account takeover at scale.
Organizations should audit Microsoft 365 tenants for forgotten service accounts, enforce MFA on all accounts including service principals, and monitor for password-spraying patterns. The TeamFiltration framework's use highlights how offensive security tooling is being integrated into commodity account-compromise campaigns.
Timeline
-
original reporting
TeamFiltration Hackers Target 5,700 Microsoft 365 Accounts to Exploit Forgotten Service Accounts
cyberpress.org · 13d ago · September 30th, 2026
Hackers using TeamFiltration targeted 5,714 Microsoft 365 accounts across 28 tenants, compromising seven forgotten service accounts in a campaign focused on Chilean organizations. Tracked the activity as UNK_CondorFiltration after detecting suspicious authentication attempts in late July 2026. The campaign generated 32,825 authentication events from 1,487 source IP addresses, all associated with Amazon Web Services EC2 infrastructure. A major Chilean retailer accounted for 53.2% of targeted accounts and 78.3% of observed events. Multiple financial institutions were also targeted. Unlike earlier TeamFiltration activity involving geographically scattered organizations, this operation focused heavily on Chile. Researchers found no confirmed compromises of personal employee accounts. Every successful takeover involved an unmanaged functional or service account, likely protected by a default or predictable password that had never been changed. TeamFiltration Exploits Forgotten Accounts TeamFiltration is a cross-platform penetration testing framework created by Melvin Langvik and publicly released at DEF CON 30. It combines account discovery, password spraying, data collection, and OneDrive file manipulation . Attackers can misuse these capabilities to compromise cloud identities and access business information. The framework validates accounts through the Microsoft Teams API and tests passwords across discovered identities. Its spraying functionality rotates AWS regions through Fi
-
update from gbhackers.com
Hackers Target 5,700 Microsoft 365 Accounts Using Forgotten Service Accounts With No MFA
gbhackers.com · 13d ago · September 30th, 2026
Threat actors have targeted more than 5,700 Microsoft 365 accounts across 28 tenants in a password-spraying campaign that successfully breached seven forgotten service accounts lacking MFA. The framework, initially created for legitimate Microsoft 365 […] The post Hackers Target 5,700 Microsoft 365 Accounts Using Forgotten Service Accounts With No MFA appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .