Meta News

A new cyberattack campaign is abusing TeamFiltration, an open-source penetration testing tool, to compromise Microsoft 365 environments and steal corporate data.

Security researchers identified seven organizations whose Microsoft 365 tenants were successfully breached during the campaign. The attacks demonstrate how tools originally created to help security teams evaluate cloud defenses can be repurposed to automate reconnaissance, password attacks and data extraction against real organizations.

The activity focuses heavily on Microsoft Entra ID identities and cloud services rather than conventional endpoint malware. This allows attackers to target information stored directly in Microsoft 365 without necessarily compromising an employee’s laptop first.

TeamFiltration was developed as a red-team framework for testing Microsoft 365 and Entra ID environments. It provides functionality for identifying valid accounts, performing password spraying, accessing services and extracting information.

Those same capabilities make it useful to attackers.

Researchers observed the threat actors using the framework to automate important stages of the intrusion process. The campaign included account enumeration and authentication attempts designed to identify credentials capable of providing access to targeted tenants.

Once attackers obtained working credentials, they could authenticate to legitimate Microsoft services and continue the operation using a valid identity. (⁠thehackernews.com)

The campaign uses proxy services to conceal the true origin of authentication attempts.

This is important because Microsoft 365 security systems frequently evaluate information such as IP reputation and geographic location when determining whether a login appears suspicious.

By routing activity through different infrastructure, attackers can make large-scale account attacks more difficult to correlate.

The operators also rotate infrastructure as they move between targets, reducing the value of blocking individual IP addresses. (⁠thehackernews.com)

For defenders, this means relying exclusively on IP-based detection is unlikely to be sufficient.

Authentication behavior, account activity and subsequent access to cloud resources become equally important signals.

After compromising an account, attackers can access information through legitimate Microsoft 365 APIs and applications.

Depending on the user’s permissions, this could expose email, corporate documents, directory information and other resources stored inside the tenant.

The attack therefore demonstrates an important shift in enterprise security.

Historically, defenders concentrated heavily on detecting malware running on endpoints. In cloud-first environments, however, an attacker with valid credentials may not need to install malware at all.

They can simply authenticate.

From the perspective of many security controls, the resulting traffic originates from legitimate Microsoft applications and APIs. Detecting the intrusion requires identifying that the behavior of the authenticated identity is abnormal, even though the authentication itself succeeded.

Multi-factor authentication can significantly reduce the effectiveness of password spraying because knowing a valid password alone is no longer sufficient.

Organizations should particularly protect privileged accounts and identities with access to sensitive Microsoft 365 data.

However, MFA should not be treated as the only defense. Attackers increasingly use phishing, session theft and other techniques to bypass or circumvent weaker forms of authentication.

Phishing-resistant authentication methods, including FIDO2 security keys and passkeys, provide stronger protection than authentication mechanisms that rely on easily intercepted codes or approval prompts.

Organizations should also monitor for unusual authentication patterns, unexpected access to cloud services and large or unusual data downloads.

The TeamFiltration campaign illustrates why identity has become one of the most important security boundaries in modern enterprise environments.

When email, documents, collaboration tools and business applications operate in the cloud, compromising an identity can provide attackers with direct access to valuable information without requiring traditional network intrusion.

Open-source offensive security frameworks make these attacks easier to automate.

Tools such as TeamFiltration have legitimate uses for penetration testing and red-team exercises, but attackers can use the same capabilities to enumerate thousands of accounts, test credentials and extract data efficiently.

For organizations relying heavily on Microsoft 365, protecting endpoints is no longer enough. Authentication telemetry, identity protection, conditional access policies, phishing-resistant MFA and monitoring of cloud activity need to be treated as core security controls.

The seven confirmed compromises demonstrate that the threat is not theoretical. Attackers are actively using cloud-focused offensive tools to turn stolen or weak credentials into direct access to corporate information.