Password spraying across Chilean Microsoft 365 tenants lands on default-password service accounts
Proofpoint tracked a TeamFiltration password-spraying campaign from July to August 2026 against 28 Microsoft 365 tenants in Chile, aimed at major banks and a large retailer. It sprayed more than 5,700 accounts from 1,487 AWS IP addresses and compromised seven, all functional or service accounts with no MFA on default or never-rotated passwords; six fell within seven minutes.
- Victim
- Multiple: 28 Microsoft 365 tenants of Chilean retailers and financial institutions
- Industry
- Cross-industry
- Country
- Chile
- Intrusion began
- Jul 21, 2026
- First disclosed
- Sep 24, 2026
- Actor
- UNK_CondorFiltration (Proofpoint) (Unattributed)
- Initial access
- Password spraying
- Identity control that failed
- Non-human identity
- MFA
- Not enforced on the abused account
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
The humans held; the unowned service accounts did not. Inventorying functional accounts, removing interactive sign-in or enforcing MFA on them, and rotating provisioned default passwords would have left the spray with nothing.
Go deeper on SWI
- Technique: Password spraying
- Product involved: Microsoft Entra ID
- SWI coverage: teamfiltration spraying found seven service accounts on default passwords
Sources
- TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords, The Hacker News, Sep 24, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Nobelium password spray campaign and Microsoft support agent compromise 2021 · Password spraying
- Midnight Blizzard password spray into Microsoft corporate email 2024 · Password spraying
- FortiBleed campaign harvests credentials through FortiGate devices 2026 · Credential stuffing
- JadePuffer wipes Azure resources with compromised service principals 2026 · Exposed secrets
Cite this record
SWI Community Team. (2026). Password spraying across Chilean Microsoft 365 tenants lands on default-password service accounts. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-teamfiltration-chile-service-accounts/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.