Over 80,000 Microsoft Entra ID accounts targeted by a stealthy takeover campaign using the open-source tool TeamFiltration.

Attackers exploit Microsoft Teams API & AWS servers worldwide to spray passwords, exfiltrate data, and plant persistent access.

CheckDot is SAFU research on CheckDot