TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords

Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants. According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. "The campaign compromised 7 accounts –

Proofpoint reported that the UNK_CondorFiltration campaign targeted more than 5,700 accounts across 28 Microsoft 365 tenants and compromised seven unmanaged service accounts using likely default or unrotated passwords without MFA. The activity primarily affected Chilean organizations and involved password spraying from 1,487 AWS EC2 source IP addresses. RealGround analysis: although the report does not identify an AI-specific attack, compromised Microsoft 365 service accounts can create exposure for SaaS-connected AI tools, agents, data, and business workflows; readiness assessment and business-logic review can help identify and contain that risk.