Key Takeaways Threat actors are using compromised university email accounts to distribute job-based advanced fee fraud. College students are uniquely vulnerable due to financial pressure and trust in institutional email. Threat actors leverage form-based credential harvesting rather than traditional, web-based phishing kits. These campaigns demonstrate multi-stage monetization, not isolated scam activity. Overview Proofpoint is tracking a cluster of threat activity specifically targeting U.S. universities. The fraud ecosystem observed in campaigns aligns with known advance fee fraud (AFF) tactics. The campaigns begin with credential harvesting attempts that lead to job scam monetization leveraging AFF. University students, staff, and alumni are a perennial target for many different types of cybercrime, including job scams, fake scholarships, and account takeover (ATO) activities. Threat actors find higher education email accounts valuable for a variety of reasons including: younger students may have less experience with email correspondence and are new to engaging with potential work or money-making opportunities; alumni may still have active email accounts, but may not use them frequently, providing an opportunity for threat actors to hijack their contact lists; and staff and faculty are constantly receiving communications from students, parents, community members, etc. from a variety of personal and university emails. By gaining access to a .edu account, threat actors can use the authority of the TLD to lend credibility to their scams both inside and outside of the target organization. In this report, we’ll highlight two different cybercrimes conducted by the same threat actors, revealing an attack chain that uses credential phishing to facilitate fraud targeted at university affiliated individuals. By understanding the entire attack chain, organizations can better educate users, improve detections, and potentially disrupt ongoing activity. Campaign Details Campaigns typically start with an initial email lure requesting a password verification or refresh. Then, the recipient is directed to a web-based form, hosted on legitimate services like Google forms, Wix, Jotform, Zoho Forms, and Microsoft Office. If the user fills out the form that usually asks for usernames, passwords, and personally identifiable information (PII), then that information is captured and sent to the threat actor to facilitate account compromise. The actor will use the compromised, trusted university account to send new emails relating to job or internship opportunities. These ultimately lead to AFF. The initial lures aim to entice a wide range of university targets. Topics include a broad-based threat of account deactivation due to “retirement, graduation, or transfer.” The email directs the potential victim to fill out a web form on a third-party website. Figure 1: “Account deactivation” lure. Many of these form submission websites implement word filtering on forms to prevent users from entering sensitive information such as passwords. As a result, the threat actors often avoid explicitly including terms like “password” in the form fields. Instead, they guide or coach the victim on which field should be used to enter their password. In the example above, they use the descriptive placeholder “WORDWORD” in place of the word “password.”                   “Note: ‘WORDWORD’ in the form refers to your password.” In addition to capturing credentials the forms also harvest a wide variety of PII such as legal name, phone numbers, university email address, and personal email addresses. This allows the threat actors to leverage personal information for follow on activity, like crafting more personal or believable lures, expanding targeting to personal inboxes, or potentially identity theft. The form does not actually reset or update anything. The victim believes they've completed a routine IT task. The attacker now has valid credentials. It’s worth noting the actors are not using more advanced credential capture techniques like attacker-in-the-middle (AiTM) phishing for multifactor authentication credential theft, or device code phishing. In these cases, ATO can only be achieved if there is no second-factor authentication implemented. Figure 2: Credential Harvesting Form with WORDWORD standing in for PASSWORD. Figure 3: Fake university form. Figure 4: Fake university form. Figure 5: Fake university form. Once they have compromised an account, the threat actors will leverage it to make money. Using the compromised email accounts, the adversary will pretend to be university staff members, or an affiliate linked to the university, and broadly distribute emails purporting to relate to job openings. Proofpoint researchers have observed a variety of different employment lures, ranging from personal concierges and remote charity staff to university research assistants and secret shoppers. Emails contain links to the purported opportunity, however they’re actually the same type of third-party web-based forms the actors used for phishing. But this time, these forms look like job applications. Figure 6: Job scam email lure for a “remote personal assistant”. Like the credential harvesting forms, these web forms are designed to harvest enough information from a victim that even if they cannot monetize it immediately, they have other options for monetization in the future. Figure 7: Job description on the web form. Figure 8: Promises of remote work and competitive benefits on the form. Figure 9: Harvesting Personally Identifiable Information. The fraudulent landing pages and related forms feature a wide variety of different themes and designs, depending on the topic. Some collect only emails, passwords, and PII, like the example below: Figure 10: “Errand runner” job application. While others ask for information such as gender, bank information, or payment accounts, in addition to personal details. Figure 11: “Secret shopper” and “personal assistant” job application with mailing address, bank, and gender questions. Some of the forms also bear hallmarks of LLM-generation, with repetitive lists, emoji, and generic descriptive content. It is unlikely the use of AI changes the likelihood of engagement or efficacy of the campaign, but may reduce the amount of time the threat actors spend creating malicious webpages. Figure 12: AI-generated fake “virtual admin” job application. Engaging With The Scammers To understand how threat acters monetized these scams, Proofpoint researchers engaged with a number of fraudsters directly from various campaigns. Each time the scenario was very similar: The threat actors first told the researchers to submit a resume via email. Then, they asked follow-up questions including, “Do you have access to a printer?” and “Do you have mobile banking?” Once these questions were answered to the scammer’s satisfaction, the threat actors emailed a scanned copy of a check (on average about $1000). They instructed the victim to do a mobile deposit and to keep a portion (typically about half) as payment for their first week of employment. For the rest of the “earnings”, the target is instructed to purchase gift cards in $100 increments. This is to avoid some retail stores’ anti-fraud efforts. Finally, targets are then told to send the gift card codes back to the threat actor. If the target did not follow their instructions, threat actors became increasingly insistent on getting the money any way possible, suggesting Bitcoin and banking services like PayPal and CashApp. When they did not receive the money, they became hostile and started texting and calling from multiple different phone numbers asking for updates of when they would get paid. After still not receiving their payment, the fraudsters resorted to threats. On one occasion, they impersonated an FBI agent and threatened legal action and arrest. Figure 13: Threat actor engagement with Proofpoint researcher. Figure 14: Threat actor escalation with Proofpoint researcher. Figure 15: Text message from the scammers claiming to be an “FBI agent” named “Agent Dozier Jr.” This name, which is real, and this unrelated person’s image, have previously been used by various fraudsters and shared widely on the internet. Attribution Many types of online-based crimes consistently originate in specific geographies, although not necessarily exclusively. Telephone-oriented attack delivery (TOADs) threat actors are often based in Indian call centers to enable phone-based fraud and malware delivery; pig butchering (cryptocurrency investment scams) are often based out of Southeast Asian countries including Cambodia and Myanmar. In the case of AFF, Proofpoint researchers regularly observe geographic linkages to West African-based fraud operations, mainly in Nigeria. During engagements with the university-targeting threat actors, in which we pretend to be a victim to understand the full attack chain, Proofpoint researchers sent several tracking links to them via Grabify. The fraudsters thought they were chatting with a real victim. Grabify is an IP logging and URL shortening service used by online marketers. These links are used to extract information such as device information and IP addresses. When the scammers clicked the links, our researchers could see where they were clicking from. Each engagement found these threat actors’ operations to be in Nigeria. While it is possible for threat actors to spoof their infrastructure, based on our investigations from hundreds of engagements, these AFF fraudsters typically use their real mobile network infrastructure to conduct their crimes. Even if the scammers do use a VPN, they often still click on researchers’ links from their genuine devices due to the multi-platform communication style they use (and the desire to monetize, despite possible deanonymization). Figure 16: One example of an IP that conducted fraudulent activity. Figure 17: Geographic data relating to an IP that conducted fraudulent activity. Figure 18: Information related to an IP that conducted fraudulent activity. Conclusion Universities will remain a valuable target for many kinds of threat actors from espionage to cybercrime, but the good news is the fraud described in this report can be prevented. Proofpoint recommends the following: Require the use of multifactor authentication (MFA) on all accounts. AFF scammers target “low-hanging fruit” and don’t typically attempt to compromise user accounts that have MFA enabled. Remain vigilant about unsolicited job offers, no matter the platform or application on which it is received. These types of fraudsters often use social media and SMS in addition to email for initial outreach. Never provide any money to a person who claims to be an employer. While this particular scam relies on the target cashing a fraudulent check and purchasing gift cards, Proofpoint has observed other types of job fraud that attempt to steal cryptocurrency, or that ask for payment for alleged goods and services like computer equipment.

Key Takeaways Proofpoint researchers identified an active TeamFiltration campaign - tracked as UNK_CondorFiltration, that targeted over 5,700 accounts across 28 Microsoft 365 tenants in Latin America, focusing intensively on Chilean organizations. All 7 successfully compromised accounts were unmanaged functional/service accounts with no prior legitimate login baseline, strongly indicating default or predictable passwords that had never been rotated, with no MFA enforcement. Several compromised accounts showed post-access activity beyond the initial credential validation: the attacker signed in from a German VPN node, attempted to authenticate to the corporate VPN, and accessed several Azure apps, including OfficeHome, Azure Portal, and SharePoint Online. Intro In late July 2026, Proofpoint threat researchers detected a concentrated Microsoft 365 brute-force campaign targeting Chilean organizations. The attacker's tooling left a familiar artifact: the hardcoded user agent unique to TeamFiltration  - a cross-platform offensive framework publicly documented by Proofpoint in the UNK_SneakyStrike blogpost. The campaign was concentrated almost entirely on Chilean organizations, with a major retailer and multiple financial institutions among the primary targets. The attacker likely sprayed accounts with default passwords - credentials provisioned by IT and never rotated. Against personal employee accounts, this approach yielded no confirmed compromises, since users are required to change passwords from time to time. Against dormant service accounts, it worked. These accounts were provisioned to run business operations and then left unmonitored, still carrying their original credentials.  Every confirmed compromise traced back to the same likely root cause: a default password on a forgotten account. Attack Tool Overview: What Is TeamFiltration? TeamFiltration is a cross-platform offensive framework built by Melvin Langvik (@Flangvik / TrustedSec) for penetration testing Microsoft 365 environments. First used internally in January 2021 and publicly released at DEF CON 30 in a talk titled "Taking a Dump In The Cloud," it automates four attack phases that chain reconnaissance through exfiltration: Module Description Enumeration Validates account existence at ~300 emails/sec via the Teams API - without triggering account lockouts. Spray Systematically tests common or targeted passwords across enumerated accounts, rotating AWS regions via FireProx to evade IP-based blocking. Exfiltrate After access is obtained, harvests email, Teams chats, OneDrive/SharePoint files, and Graph API data automatically. Backdoor Grants interactive OneDrive access to browse, download, and silently replace files - enabling an attacker to plant malicious files in place of legitimate ones, triggering execution the next time the file is opened. The Attribution Fingerprint TeamFiltration's default configuration includes a hardcoded user agent string from a 2020 Microsoft Teams desktop client - a non-common version these days: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.30866 Chrome/80.0.3987.165 Electron/8.5.1 Safari/537.36" Campaign Overview The campaign was concentrated almost entirely on Chilean organizations - with one major retailer accounting for 78.3% of all observed events. This regional focus is a notable departure from the geographically distributed targeting seen in UNK_SneakyStrike. Campaign Statistics Metric Value  Total authentication events 32,825 Unique accounts targeted 5,714 Unique source IPs 1,487 (All AWS EC2) Tenants targeted 28 Accounts compromised 7 Primary target sector Retailer(53.2% of accounts) Figure 1: Campaign Activity Timeline — daily unique accounts targeted, Jul 21–Aug 16 Activity Timeline The campaign unfolded across three distinct bursts over a 26-day window: Jul 21-24 A small-volume opening wave targeted approximately 100–120 unique accounts per day. This activity was directed primarily at two major Chilean banking institutions. Jul 26-28 Spray volume surged to a peak of roughly 1,520 accounts on Jul 27 before collapsing sharply. This wave targeted another major Chilean financial institution. Aug 13-16 After approximately two weeks of silence, the operator returned with a second high-volume burst, peaking at around 1,560 accounts on Aug 15 - marginally exceeding the July peak. This wave shifted focus to a major Chilean retailer, where all seven confirmed account compromises and the observed post-access activity occurred on Aug 14–15. Target Landscape Domain Accounts % Accounts Events % Events Outcome Major retailer 3,038 53.2% 25,715 78.3% 7 accounts compromised Major financial institution #1 1,873 32.8% 3,776 11.5%   N/A Major financial institution #2 110 1.9% 1,536 4.7% N/A Other Chilean orgs 217 3.8% 464 1.4% N/A Other (non-Chile) 476 8.3% 1,334 4.1% N/A Notable Side Target A major Chilean banking institution was targeted in 1,536 (Major financial institution #2) authentication attempts across the small amount of 114 accounts. Over half of those attempts (782) targeted 57 senior accounts, including multiple managers. Dormant Accounts as the Attack Surface The attacker targeted more than 5,700 accounts across 28 tenants and achieved zero compromises against personal employee accounts. Every confirmed breach involved a functional or service account. A review of login telemetry for all 7 compromised accounts revealed a consistent and striking pattern: none had any prior legitimate user sessions in the period covered by our telemetry. These accounts were not used by humans. They were created to run business operations - managing tickets, approving vendor payments, operating a point-of-sale system, and handling requests - then left idle, still active in the tenant's identity plane, but belonging to nobody. Six of them compromised within 7 minutes during the campaign - strongly suggesting a shared or default password set consistent with an organizational provisioning process, not individually targeted credential stuffing. Why Service Accounts Are the Perfect Target Service accounts are particularly vulnerable due to a combination of predictable usernames, default passwords, and weak security controls in addition to lack of ownership of a human (sometimes). These accounts are usually being poorly managed and overlooked. These accounts usually lack MFA. Post-Compromise: Beyond the Password For most of the compromised accounts, the only post-login activity observed was access to “Microsoft Office” and “OneDrive” alongside “Teams”. This was done from the same AWS infrastructure. This matches TeamFiltration's -auto-exfil mode, which automatically pulls email, Teams conversations, and OneDrive files after a successful sign-in. Sign-in logs alone cannot confirm exfiltration occurred, but the access pattern points to it. A Compromised Service Account: Case Study in Post-Compromise Activity Within 90 seconds of the successful compromise, the attacker switched from the TeamFiltration infrastructure to a German VPN node and began a post-access sequence: probing the corporate VPN, accessing Azure Portal, browsing SharePoint, and triggering a Microsoft Graph API token request. Time (UTC) Application IP / ISP Action 18:41:41 Microsoft Teams 3.101.157.240 amazon.com Initial compromise via password spray 18:42:30 Corporate VPN Portal (vpn.[redacted].cl/SAML20/SP) 149.88.104.19 cdn77.com/DE Corporate VPN probe - FAILED (MFA/CA blocked entry). Telemetry records target_application_id = https://vpn.[redacted]/SAML20/SP 18:43:29 Azure Portal 149.88.104.19 cdn77.com/DE Azure Portal access triggered an MFA enrollment prompt (userstrongauthenrollmentrequiredinterrupt), indicating the account had no MFA configured at the time of compromise. 19:03:59 OfficeHome 149.88.104.19 cdn77.com/DE M365 Portal access 19:07:23 SharePoint Online 149.88.104.19 cdn77.com/DE File system access - potential document reconnaissance, exfiltration or backdoor delivery 19:07:35 SharePoint Online Web Client Extensibility 149.88.104.19 cdn77.com/DE Client-side code requested an access token to interact with Microsoft Graph or external APIs   Applications Accessed by the Attacker Application App ID Accounts Purpose  TeamFiltration via AWS infrastructure Microsoft Teams 1fec8e78-bce4-4aaf-ab1b-5451cc387264 All 7 Enumeration, credential spray, and Teams chat/file exfiltration Microsoft Office d3590ed6-52b3-4102-aeff-aad2292ab01c  All 7 Email and calendar exfiltration (Outlook REST) OneDrive SyncEngine ab9b8c07-8f02-4f72-87fa-80105867a763 subset of accounts File exfiltration and OneDrive backdoor German VPN Corporate VPN Portal (SAML) https://vpn.[redacted]/SAML20/SP subset of accounts Corporate VPN access attempt Azure Portal c44b4083-3bb0-49c1-b47d-974e53cbdf3c one compromised account Azure Portal access OfficeHome (M365 Portal) 4765445b-32c6-49b0-83e6-1d93765276ca one compromised account M365 Portal access SharePoint Online 00000003-0000-0ff1-ce00-000000000000 one compromised account File and document reconnaissance/exfiltration SharePoint Online Web Client Extensibility 08e18876-6177-487e-b8b5-cf950c1e598c one compromised account Client-side code requested an access token to interact with Microsoft Graph or external APIs IOCs Type Indicator Description User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Teams/1.3.00.30866 Chrome/80.0.3987.165 Electron/8.5.1 Safari/537.36 Hardcoded in TeamFiltration default config. Not seen in legitimate modern Teams clients. IP Ranges 3.101.0.0/16 18.144.76.0/24 13.52.201.0/24 Primary spray infrastructure. All resolve to amazon.com (AWS EC2). IP (Post-access) 149.88.104.19 cdn77.com / datacamp.co.uk German VPN that used for VPN probing, Azure Portal access, and SharePoint recon. Conclusion The UNK_CondorFiltration campaign is a reminder that one of the weakest links in an enterprise identity perimeter is often not a phished employee or a zero-day exploit. It is the forgotten account. Service accounts provisioned for convenience and never revisited are a structurally unprotected attack surface.