Cybersecurity researchers have disclosed details of an active TeamFiltration campaign codenamed UNK_CondorFiltration that has targeted over 5,700 accounts across 28 Microsoft 365 tenants.
According to Proofpoint, the activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses.
“The campaign compromised 7 accounts – all of which were unmanaged functional or service accounts rather than individual employee accounts – highlighting a critical exposure gap around forgotten, non-human identities carrying default or unrotated passwords and no MFA [multi-factor authentication],” the enterprise security company said in a statement.
The Microsoft 365 brute-force campaign is said to have unfolded across three different waves from late July to August 2026, with an unnamed Chilean retailer facing the brunt of 78.3% of all observed authentication events –
- July 21-24, targeting approximately 100–120 unique accounts per day and directed against two major Chilean banking institutions
- July 26-28, targeting a peak of about 1,520 accounts on July 27 before dropping sharply and directed against another major Chilean financial institution
- August 13-16, targeting a peak of about 1,560 accounts on August 15 and directed against a major Chilean retailer, leading to seven account compromises
Evidence indicates that the threat actor likely sprayed accounts with default passwords, including credentials provisioned by IT teams and never rotated. The activity mainly targeted dormant service accounts as opposed to personal employee accounts, since users are mandated to change passwords from time to time.
These service accounts, per Proofpoint, were provisioned to run business operations and then left unmonitored, while still carrying their original credentials. Every successful compromise has been linked to unmonitored service accounts with a default password.
Six of the seven compromised accounts were broken into within 7 minutes, likely indicating a shared or default password set rather than individually targeted credential stuffing.
The activity is characterized by the use of TeamFiltration, a legitimate cross-platform offensive framework designed for “enumerating, spraying, exfiltrating, and backdooring” Entra ID accounts. It allows an operator to validate email accounts, test common or targeted passwords across enumerated accounts, harvest sensitive data, and gain covert, interactive access to OneDrive.
Across most of the compromised accounts, the threat actor leveraged the foothold to access Microsoft Office, OneDrive, and Teams, potentially indicative of data harvesting and exfiltration. That said, sign-in events alone cannot be taken as evidence of exfiltration.
Less than 2 minutes after successful compromise, the operator has been observed pivoting to a German VPN node to probe the corporate VPN (“vpn.[redacted].cl/SAML20/SP”), access Azure Portal, browse SharePoint Online, and initiate Microsoft Graph API token requests.
This is not the first time TeamFiltration has been put to use in malicious attacks. In June 2025, Proofpoint detailed another threat cluster dubbed UNK_SneakyStrike that targeted over 80,000 user accounts across hundreds of organizations’ cloud tenants using the open-source penetration testing framework.
“The UNK_CondorFiltration campaign is a reminder that one of the weakest links in an enterprise identity perimeter is often not a phished employee or a zero-day exploit,” Proofpoint said. “It is the forgotten account. Service accounts provisioned for convenience and never revisited are a structurally unprotected attack surface.”
