Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations

This article covers an Iran-linked password-spraying campaign targeting Microsoft 365 environments across 300+ Israeli and 25+ UAE organizations in early 2026.

• •The campaign ran in three attack waves (March 3, 13, and 23, 2026), targeting government, municipalities, technology, transportation, and energy sector organizations.
• •Attackers used Tor exit nodes and commercial VPN nodes (AS35758) for aggressive scanning and password-spraying, with techniques linked to Gray Sandstorm (formerly DEV-0343).
• •The attack chain involved password spraying, credential login, and mailbox data exfiltration from M365 environments.
• •Recommended defenses include monitoring sign-in logs, conditional access controls by geography, enforcing MFA, and enabling audit logs.
• •