Security researchers at Proofpoint have disclosed an active campaign, internally tracked as UNK_CondorFiltration, that used a publicly available penetration-testing tool to fire tens of thousands of login attempts at Microsoft 365 accounts across dozens of organizations — and the handful of accounts it actually broke into all shared exactly one thing in common: nobody was watching them.

The tool: TeamFiltration

The campaign runs on TeamFiltration, a cross-platform offensive framework originally built for legitimate penetration testing of Microsoft 365 environments, first used privately in January 2021 and released publicly at the DEF CON 30 security conference. The tool automates the entire attack lifecycle in four stages: it first enumerates which email addresses correspond to real accounts by querying the Microsoft Teams API at roughly 300 addresses per second without triggering account lockouts, then sprays common passwords against the confirmed accounts while rotating across AWS regions using a technique called FireProx specifically to dodge IP-based blocking. Once inside an account, it automatically harvests email, Teams chat logs, and OneDrive and SharePoint files via Microsoft's Graph API, and can optionally plant a persistent backdoor through interactive OneDrive access.

Three waves, one clear target

Proofpoint's telemetry traces the campaign across three distinct waves. An initial wave from July 21–24 tested 100–120 accounts a day against two major Chilean banking institutions. A second wave, July 26–28, escalated sharply, peaking at roughly 1,520 targeted accounts in a single day against a separate Chilean financial institution. After a two-week pause, a third wave resumed August 13–16, again reaching around 1,560 accounts in a day, this time concentrated on a major Chilean retailer — and it was here, on August 14 and 15, that all seven of the campaign's successful account compromises occurred.

In total, Proofpoint recorded 32,825 authentication attempts against 5,714 unique accounts spread across 28 separate Microsoft 365 tenants, all originating from 1,487 unique IP addresses — every one of them traced back to Amazon Web Services EC2 infrastructure. A distinct second set of infrastructure, routed through a German VPN provider, was used for follow-on activity after a successful login.

Why only service accounts fell

The detail that matters most in Proofpoint's writeup isn't the scale of the attempts — it's which accounts actually failed. All seven successful compromises hit unmanaged functional or service accounts: the kind of account IT teams set up for an application, an integration, or an automated process, then frequently forget about entirely. Every one had a default or long-unrotated password, and none had multi-factor authentication enabled. By contrast, the campaign recorded zero successful compromises against ordinary employee accounts, which in these organizations were protected by enforced password rotation and MFA.

Once inside, the attackers moved quickly: within 90 seconds of a successful login, one attacker had already pivoted to different infrastructure and begun probing the compromised organization's corporate VPN, Azure Portal, and SharePoint Online. Several of those follow-on attempts were themselves blocked by conditional access policies and MFA enrollment prompts on downstream systems — meaning that even after the initial account fell, layered defenses elsewhere in the environment limited how far the intrusion could spread. Researchers also identified a distinctive, outdated Microsoft Teams client user-agent string — corresponding to a 2020 version rarely seen in real modern traffic — hardcoded into the tool's requests, which became a reliable fingerprint for attributing the activity to TeamFiltration.

What organizations should do

Proofpoint's core recommendation is the same lesson every account-based intrusion eventually teaches: the weakest point in an identity perimeter is rarely a zero-day or even a phished employee — it's the account nobody remembers exists. Security teams are advised to maintain a current inventory of all service and functional accounts, enforce mandatory password rotation across every account type rather than only human ones, require MFA on service accounts wherever the underlying application supports it, and set up baseline monitoring so an authentication pattern from a service account that has never logged in from a new location before gets flagged rather than ignored.