A 5,700-account Microsoft 365 spray in Chile broke only unrotated service accounts

Seven compromises against more than 5,700 targeted accounts is a success rate of about 0.12 percent ^[1]. The spraying came from 1,487 unique AWS EC2 source addresses over 27 days ^[3][2], and one unnamed Chilean retailer absorbed 78.3 percent of the authentication events Proofpoint observed ^[5].

Six of the seven accounts were broken within seven minutes ^[11]. Proofpoint attributes that speed to a shared or default password set, and says it was not credential stuffing with individually harvested passwords ^[11]. The earlier waves were larger and produced nothing: roughly 100 to 120 unique accounts a day against two major Chilean banking institutions between July 21 and 24 ^[6], then a peak near 1,520 accounts on July 27 against another financial institution before the volume dropped ^[7].

No individual employee account was compromised ^[4]. Users in those tenants are required to change passwords periodically, according to Proofpoint. The dormant functional accounts were provisioned to run business operations and then left unmonitored with their original credentials ^[9]. "It is the forgotten account," Proofpoint said in a statement. "Service accounts provisioned for convenience and never revisited are a structurally unprotected attack surface." ^[16]

The tooling is public. TeamFiltration is a legitimate cross-platform offensive framework for "enumerating, spraying, exfiltrating, and backdooring" Entra ID accounts. It gives an operator email validation, password testing across enumerated accounts, data harvesting and covert interactive access to OneDrive ^[12]. Proofpoint documented a different cluster using the same framework in June 2025, UNK_SneakyStrike, against more than 80,000 accounts across hundreds of organizations' cloud tenants ^[15]. This target list is about 7 percent of that size ^[3], narrowed onto Chilean retail and finance ^[2].

On most of the compromised accounts the operator signed into Microsoft Office, OneDrive and Teams, which Proofpoint says may indicate data harvesting ^[13]. Sign-in events alone cannot be taken as evidence of exfiltration, the company said ^[13]. The campaign account comes from Proofpoint, and the targeted organizations are not named ^[1].