Hackers are leveraging overlooked machine accounts in Microsoft 365 (M365) to steal enterprise data from organizations in Chile.
Within any organization's M365 environment, there are accounts that belong to humans, sure, but also shared functional identities and accounts for applications and automated processes. Individuals are responsible for their own identities, but who keeps track of, maintains, and secures those nonhuman ones? Without due diligence, those types can fall out of focus and become forgotten relics with default credentials and excessive permissions.
At Proofpoint Protect 2026 in San Diego, Calif., researchers at Proofpoint unveiled an as-yet-unknown threat actor trying to break into Chilean organizations' M365 environments. Using an open source (OSS) toolkit and basic credential spraying, the actor didn't manage to break into a single employee account belonging to any of their targets. Instead, nonhuman accounts became their key to getting in, allowing them to gain access to a variety of sensitive data worth exfiltrating.
M365 Compromise in Chile
Using the "TeamFiltration" tactic is one of the easiest, laziest ways to hack an organization's M365 environment. Developed half a decade ago and debuted to the public as part of the fantastically titled DEF CON 30 presentation, "Taking a Dump in the Cloud," TeamFiltration is an all-in-one, OSS M365 hacking kit. Ethical and nonethical hackers alike can point it at a M365 tenant, enumerate the accounts it contains, and brute-force them, all while rotating infrastructure to avoid IP blocking. Then the tool can facilitate broad data exfiltration and backdooring across connected Microsoft applications.
Beginning on July 21, a threat actor that Proofpoint currently tracks as UNK_CondorFiltration began a TeamFiltration campaign. At first, it probed hundreds of M365 accounts associated with two major banking institutions in Chile. A week later, it probed thousands at a third financial institution in the same country. None of this appears to have amounted to much.
After a quiet couple of weeks, in mid-August, the threat actor came back with a third wave of TeamFiltration attacks. This time, it aimed all of its cannons at a single target: a major Chilean retailer. And this time, it succeeded in compromising seven corporate accounts.
The breakthrough wasn't some new tool or tactic. In a campaign spanning more than 5,700 accounts across 28 different M365 tenants, UNK_CondorFiltration still hadn't breached a single employee account. However, this time, it had identified seven functional and service accounts that the retailer seemed to have forgotten about, or perhaps never knew existed.