Adobe
TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords
At a glance
Low rather than Medium: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on Microsoft 365, treat it as Medium.
Briefing
- Leaders should assess whether their estate contains unmanaged service accounts with default passwords that may be vulnerable to similar attacks.
Next steps
Monitor- For awareness — no fixed action deadline for this reporting
- Seven service accounts were compromised due to default passwords, with evidence suggesting the threat actor used credentials provisioned by IT teams and never rotated.
Next steps
Monitor- No immediate technical action — track if your estate depends on the products or vendors discussed
Summary
- TeamFiltration targeted over 5,700 Microsoft 365 accounts across 28 tenants, compromising seven service accounts with default passwords.
- The campaign compromised seven accounts, all of which were unmanaged functional or service accounts rather than individual employee accounts.
Read the original reportProofpoint Threat Insight(opens in a new tab)
Products and services involved
- Microsoft 36598% match confidence
- Adobe Campaign94% match confidence
Pulse
Last checked 25 Oct · Recheck overdue since 1 Nov 2026, 14:32 UK time · 2 quiet checks collapsed
- Story10 Oct 2026, 01:02 UK time · 10 Oct
Linked reporting from Proofpoint Threat Insight (research).
Read source (Proofpoint Threat Insight)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- Proofpoint Threat InsightResearcher
TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
TeamFiltration Campaign Compromises Seven Microsoft 365 Accounts Using Default Passwords
- ProbableSummary fact75% confidence
TeamFiltration targeted over 5,700 Microsoft 365 accounts across 28 tenants, compromising seven service accounts with default passwords.