TeamFiltration Campaign Targets Microsoft 365 Accounts in Chile

• •Seven Microsoft 365 accounts compromised using default passwords.
• •Attack focused on Chilean retail and financial sectors with over 5,700 accounts targeted.
• •TeamFiltration framework utilized for automated password spraying and data access.

A TeamFiltration campaign, codenamed UNK_CondorFiltration, has compromised seven Microsoft 365 accounts across 28 tenants, primarily affecting Chilean retail and financial institutions. The attackers targeted over 5,700 accounts using default or unrotated passwords on unmanaged service accounts, which had no multi-factor authentication (MFA) enabled. The campaign unfolded in three waves from late July to August 2026, with one unnamed retailer experiencing 78.3% of authentication events. The attackers utilized a cross-platform offensive framework known as TeamFiltration, which automates account validation and password spraying. Evidence suggests that six of the seven compromised accounts were breached within seven minutes, indicating a shared or default password. The threat actor's activity included accessing Microsoft Office, OneDrive, and Teams, potentially for data harvesting. The campaign highlights significant vulnerabilities in managing service accounts and enforcing password policies.