TeamFiltration Campaign Cracks Seven Microsoft 365 Accounts via Default Passwords

Proofpoint researchers have disclosed the details of an active campaign built around the TeamFiltration tool. Codenamed UNK_CondorFiltration, the operation targeted more than 5,700 accounts across 28 Microsoft 365 tenants, focusing chiefly on Chilean retailers and financial institutions. The traffic came from 1,487 unique AWS EC2 source IP addresses.

Of all the accounts probed, only seven were compromised — and none belonged to an actual employee. Every one was an unmanaged functional or service account carrying a default or unrotated password and no multi-factor authentication. Proofpoint frames this as a critical exposure gap: forgotten non-human identities are a structurally unprotected attack surface.

Three waves

The campaign played out in three stages from late July through August 2026. From July 21 to 24, the spraying hit two major Chilean banks at roughly 100–120 unique accounts per day. From July 26 to 28 it turned to another financial institution, peaking at about 1,520 accounts on July 27. Finally, from August 13 to 16 a major retailer took the brunt — 78.3% of all observed authentication events overall — with a peak near 1,560 accounts on August 15, and it was this wave that produced the seven successful break-ins.

The attackers appear to have sprayed default passwords, including credentials provisioned by IT teams and never rotated. They went after dormant service accounts specifically: ordinary users are periodically forced to change passwords, while service accounts spun up for business operations tend to sit unmonitored with their original credentials intact. Six of the seven compromises happened in under seven minutes — a sign of a shared or default password set rather than targeted credential stuffing.

The tool and post-compromise activity

TeamFiltration is a legitimate cross-platform offensive framework for enumerating, spraying, exfiltrating, and backdooring Entra ID accounts. After gaining a foothold, the operator reached into Microsoft Office, OneDrive, and Teams, potentially indicating data harvesting — though sign-in events alone are not proof of exfiltration.

Less than two minutes after a successful login, the operator was seen pivoting to a German VPN node to probe the corporate VPN, access Azure Portal, browse SharePoint Online, and request Microsoft Graph API tokens.

This is not TeamFiltration's first malicious outing: in June 2025 Proofpoint documented a cluster dubbed UNK_SneakyStrike that hit more than 80,000 accounts across hundreds of organizations. The takeaway, the company says, is blunt: the weakest link in an identity perimeter is often not a phished employee or a zero-day, but the forgotten account — provisioned for convenience and never revisited.

Source: The Hacker News