Iran-Linked Hackers Hit M365 Tenants in Middle East Password Spray Campaign

**Executive Summary:** Check Point Research observed an Iran-linked password-spraying campaign in March 2026 targeting Microsoft 365 tenants—primarily Israeli municipalities and several UAE organizations—aimed at intelligence collection and potentially supporting kinetic operations; attackers used password spraying, rotating VPN/Tor IPs (including Windscribe and NordVPN ranges), and an IE10 User-Agent to evade detection, impacting over 300 entities in Israel and prompting recommendations such as enforcing MFA, geo-fencing, blocking anonymization services, and retaining audit logs.