TeamFiltration Hackers Exploit Forgotten Microsoft 365 Service Accounts

Forgotten Microsoft 365 service accounts gave attackers exactly what they needed: valid usernames, weak passwords, and no MFA.

Proofpoint said a TeamFiltration campaign tracked as UNK_CondorFiltration targeted 5,714 accounts across 28 Microsoft 365 tenants, mostly in Chile. Seven accounts were successfully compromised, and each was an unmanaged functional or service account with no prior legitimate sign-in activity in Proofpoint’s telemetry. For security teams, the findings put stale non-human accounts alongside employee identities as an access path that needs regular review.

TeamFiltration sprayed 5,714 accounts across 28 tenants

Proofpoint observed 32,825 authentication events from 1,487 AWS EC2 source IPs during the campaign. TeamFiltration can enumerate Microsoft 365 accounts through the Teams API, rotate infrastructure while testing passwords, and automate access to email, Teams, OneDrive, SharePoint, and Microsoft Graph data after a successful sign-in.

The campaign produced no confirmed compromises of personal employee accounts. Six of the seven compromised accounts fell within seven minutes. Proofpoint said the timing suggested they may have used shared or default passwords tied to an organizational provisioning process rather than credentials obtained through individually targeted attacks.

The compromised accounts were still connected to business functions despite showing no prior legitimate user sessions in Proofpoint's telemetry. Researchers said they had been created for tasks such as ticket management, vendor payments, point-of-sale operations, and handling requests, then left active without the same protections applied to human users.

Compromised accounts opened paths to Azure and SharePoint

In one case, the attacker moved to a German VPN node within 90 seconds of compromise, attempted to access the corporate VPN, opened Azure Portal and SharePoint, and triggered a Microsoft Graph API token request. MFA or Conditional Access blocked the VPN attempt, while an Azure prompt indicated that the compromised account itself had no MFA configured.

Proofpoint also observed access patterns consistent with TeamFiltration's automatic exfiltration mode, which can pull email, Teams conversations, and OneDrive files after login. The researchers cautioned that sign-in logs alone could not confirm that data was actually exfiltrated.

Large-scale Microsoft 365 password spraying is not unique to TeamFiltration. Huntress reported that another campaign in June 2026 generated 81 million login attempts, compromising 78 accounts across 64 organizations. Huntress said the attack abused the deprecated OAuth ROPC flow, and MFA was enabled but misconfigured at 15 of 23 businesses hit on June 22.

Although Proofpoint did not identify AI use in this campaign, Sarah Sabotka, a staff threat researcher at the company, told eSecurity Planet that the technology could help attackers conduct similar operations at greater scale. “The real concern is how AI helps threat actors scale these attacks,” Sabotka said.

What defenders should do

Proofpoint’s findings give security teams a clear place to start: look for functional and service accounts that are still enabled but show little or no legitimate activity. All seven confirmed compromises involved service or functional accounts, and none had prior legitimate user sessions in Proofpoint’s telemetry.

Microsoft Defender for Identity recommends reviewing stale service accounts and removing those that are no longer needed. 

For accounts that must remain active, Microsoft advises reducing unnecessary privileges, restricting where they can sign in, documenting ownership, and reviewing access periodically. For on-premises Active Directory workloads, organizations can replace eligible legacy accounts with group Managed Service Accounts, which support automated password management. Cloud workloads should use managed identities or other workload identities where supported.

Security teams can prioritize three checks:

• Find stale accounts: Review service accounts with no recent login activity and confirm whether the application or process they supported still needs them.
• Reduce access: Remove unnecessary privileged roles and restrict where active service accounts can authenticate.
• Improve credential management: Replace legacy accounts with managed alternatives where possible, and make sure active accounts have a documented owner and regular access reviews.

Proofpoint said the compromise pattern suggested that the affected accounts may have used shared, default, or otherwise predictable passwords. At least one account also lacked MFA. An account that employees no longer use or monitor can still expose Microsoft 365 data and applications if it remains enabled and poorly protected.

Read more: Microsoft 365 identity attacks are also evolving beyond password spraying. The company has warned that passkey-themed phishing can hijack accounts, add rogue MFA methods, and quietly siphon business cloud data.