At a Glance Attribute Details Actor or Group UNK_Condor Filtration (unattributed cybercrime operator) Activity Type Password spraying, credential validation, cloud data exfiltration Targets or Victims 28 Microsoft 365 tenants in Latin America (primarily Chilean retailers and banks) Scale 5,714 unique accounts targeted across 32,825 login events; 7 service accounts compromised Jurisdiction / Status Unidentified cybercriminals; uncharged Source

The Iranian APT group Gray Sandstorm is suspected of conducting a large-scale password spray attack against Microsoft 365 accounts in Israel and the UAE to support kinetic military operations.

A possible Iran-Nexus password spray campaign targeted Microsoft 365 accounts across several Middle East municipalities.

Check Point Research tracked an Iran-linked, three-stage password-spraying campaign against Microsoft 365 tenants that peaked on March 3, 13, and 23, 2026 and primarily targeted municipalities in Israel and the UAE. Attackers scanned via rotating Tor exit nodes, used Windscribe and NordVPN endpoints geolocated in Israel to bypass geo-fencing, and leveraged...

A massive botnet of over 130,000 compromised devices is conducting password-spray attacks against Microsoft 365 (M365) accounts worldwide, attempting to confirm credentials.