Cybersecurity researchers discovered a new account takeover campaign that uses an open-source penetration testing framework called TeamFiltration to breach Microsoft Entra ID user accounts. The activity has targeted over 80,000 user accounts across hundreds of organizations' cloud tenants since the increase in login attempts in December 2024, leading to successful account takeovers.