Ghost Service Accounts Enable M365 Data Theft in Chile

An attack on an organization in Chile showed that forgotten and lost service accounts in Microsoft 365 can bypass protections even when employee accounts are locked down. Attackers use these "ghost accounts" to steal data across the entire M365 environment.

• Forgotten M365 service accounts bypass locked employee accounts
• The attack was observed at a Chilean organization
• A compromised account grants access to the whole M365 environment