TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords

**Proofpoint observed an active TeamFiltration campaign (UNK_CondorFiltration) that sprayed default or unrotated credentials across Microsoft 365 tenants, targeting over 5,700 accounts in 28 tenants—primarily Chilean retail and financial organizations—and compromising seven unmanaged service accounts used for business operations, enabling access to Office, OneDrive, Teams and Azure resources.**