Iran-Linked “Password Spraying” Targets Municipal Response to Missile Strikes Check Point Research tracked an Iran-linked, three-stage password-spraying campaign against Microsoft 365 tenants that peaked on March 3, 13, and 23, 2026 and primarily targeted municipalities in Israel and the UAE. Attackers scanned via rotating Tor exit nodes, used Windscribe and NordVPN endpoints geolocated in Israel to bypass geo-fencing, and leveraged...

Iran-linked hackers launched three waves of password spraying attacks in March 2026 targeting Israeli and UAE municipalities, exploiting Microsoft 365 accounts via VPNs and Tor to steal sensitive emails. #GraySandstorm #Israel #PasswordSpray