Back Scworld

Widespread Microsoft 365 account compromise sought by Iran-linked hackers

Scworld • April 1, 2026

More than 300 organizations in Israel, over 25 others in the United Arab Emirates, and a limited number of entities in the U.S., Saudi Arabia, and Europe have had their Microsoft 365 environments targeted by Iran-nexus hackers as part of a password spraying campaign that has been underway since early March, The Register reports.

Intrusions believed to assist in bombing damage assessment initiatives and kinetic operations were conducted in three waves, commencing with the widespread scanning of Microsoft accounts with weak passwords via Tor exit nodes, which is a technique commonly employed by Iranian state-backed threat operation Gray Sandstorm, according to a Check Point Research analysis. Attackers then leveraged various VPN IP addresses geolocated in Israel to log in using the stolen valid credentials and compromise emails and other sensitive information.

Such findings come as Iran-linked hacktivist operation Handala Hack leaked FBI Director Kash Patel's personal emails and breached leading U.S. medical device firm Stryker.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian APT Group Conducts Password Spray Attacks on Microsoft 365 Accounts In March 2026, a suspected Iranian APT group, identified as Gray Sandstorm, initiated a password spraying campaign targeting Microsoft 365 accounts of over 300 organizations in Israel and more than 25 in the UAE. The attacks, which occurred in three waves on March 3, March 13, and March 23, aimed to gather intelligence for bomb damage assessments following missile strikes. The attackers utilized weak password credentials and employed a rotating network of Tor exit nodes to evade detection. They then authenticated using VPN IP addresses geolocated in Israel to access sensitive data. This operation aligns with previous tactics used by Iranian state-sponsored groups and has raised concerns about vulnerabilities in regional digital infrastructure. The campaign is ongoing, with researchers continuing to monitor the situation. 9 sources 76

Extracted Entities

Widespread Microsoft 365 account compromise sought by Iran-linked hackers

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (1)

Countries (3)

MITRE ATT&CK (2)

Platforms (2)