Ghost Service Accounts Enable M365 Data Theft in Chile

Proofpoint researchers observed a threat actor (tracked as UNK_CondorFiltration) using the open-source TeamFiltration toolkit and basic credential spraying to probe thousands of Microsoft 365 accounts across multiple Chilean organizations. The actor failed to compromise employee accounts but successfully breached seven forgotten service/nonhuman accounts at a major retailer, enabling automated exfiltration of Outlook, Teams, OneDrive and SharePoint data and further probing of VPN and Azure management portals; the report recommends inventorying and tethering cloud accounts to human owners, enforcing MFA, and expiring unused accounts.