Microsoft 365 service accounts targeted in password-spraying campaign

A password-spraying campaign, tracked by Proofpoint as UNK_CondorFiltration, has targeted over 5,700 Microsoft 365 accounts across 28 tenants. The attack utilized the TeamFiltration offensive framework to automate account enumeration and data collection, leveraging 1,487 AWS EC2 source IP addresses to generate more than 32,000 authentication events.

While no standard employee accounts were compromised, attackers successfully breached seven forgotten service accounts that lacked multi-factor authentication (MFA). These breached identities were functional accounts used for critical business processes, including vendor-payment approvals, ticket handling, point-of-sale operations, and internal request processing.

The campaign heavily targeted organizations in Chile, specifically within the retail and financial sectors. One major Chilean retailer accounted for 78.3% of all observed authentication events. Investigators noted that the speed of the breaches—with six accounts compromised within seven minutes—suggests the service accounts shared predictable or unrotated default passwords established during their initial provisioning.