A recently uncovered campaign known as UNK_CondorFiltration compromised default-password Microsoft 365 service accounts across Chilean retail and financial institutions. Over a span from late July to mid-August 2026, attackers attempted logins to more than 5,700 accounts across 28 separate tenants. Seven accounts were successfully breached—none belonging to individual employees, but tied to functional or service roles left with default, unrotated credentials and no multi-factor authentication (MFA).
How the Attack Unfolded
The campaign operated in three waves. In the first wave (July 21–24), about 100–120 unique account attempts occurred daily, hitting two major banks. The second (July 26–28) saw a sharp spike, with over 1,500 accounts targeted in a single day at a major financial institution. The third wave (August 13–16) was directed at a major retailer and resulted in the seven successful compromises. These incidents seem to exploit weak operational hygiene rather than sophisticated zero-day vulnerabilities.
Attackers focused on service accounts—which are often provisioned by IT teams for automated tasks, business systems, or integration services—but then neglected. These accounts kept their default passwords, didn’t require MFA, and stayed dormant for long periods. Six out of the seven compromised accounts were breached within seven minutes, a telltale sign of password reuse across multiple systems or widespread default credentials rather than targeted credential stuffing attacks.
Capabilities and Implications of the Threat
The tool used, TeamFiltration, is a legitimate multi-platform framework intended for offensive testing of identity infrastructure. It enables attackers to enumerate accounts, test common or default passwords, and gain access to Office, OneDrive, Teams, SharePoint, and Azure environments. In these breaches, once inside, attackers quickly moved laterally—within two minutes they used a German VPN node to access corporate VPN gateways, explore SharePoint Online, call Microsoft Graph API, and probe Azure Portal.
This isn’t the first misuse of TeamFiltration. In mid-2025, a related threat cluster dubbed UNK_SneakyStrike targeted over 80,000 accounts across hundreds of Microsoft 365 tenants. These campaigns illustrate how identity-based frames are being weaponized—not via novel exploits but via weakly secured, forgotten identities.
One of the most sobering findings: the weakest link in many enterprise security setups is the unmonitored service account. While companies often impose password changes, audits, and MFA for individual employees, these functional identities often slip through the cracks—left with default credentials, without oversight, and with direct access to sensitive platforms.
What This Means: 1) Organizations must discover and inventory all service and functional accounts. 2) Rotate default credentials immediately and enforce MFA across all identities, not just human users. 3) Monitor for signs of brute-force sprays, especially rapid-fire logins across multiple accounts. 4) Treat every identity—human or machine—as a potential attack surface to defend.
The UNK_CondorFiltration campaign is a stark reminder that cyber defense often fails not from grand exploits, but from small, preventable oversights. As attacks like this proliferate, every enterprise should revisit its identity hygiene and close the door on forgotten but dangerous access points.
