// Microsoft 365MEDIUM
Threat actors tracked as UNK_CondorFiltration conducted a password-spraying campaign against 5,700+ Microsoft 365 accounts across 28 tenants using the TeamFiltration framework, successfully compromising seven unmanaged service accounts at Chilean retail and financial organizations between July 21 and August 16, 2026. Attackers leveraged forgotten service accounts lacking MFA and predictable default credentials to gain access to Teams, OneDrive, SharePoint, and Azure Portal resources. All seven confirmed compromises were dormant functional accounts used for business processes, with no evidence of ordinary employee account takeover.
// Get alerts for Microsoft 365