high Code Vulnerability
Iran-Nexus M365 Password Spraying — 300+ Israeli Organizations
| Severity | high |
| Status | open |
| Date | April 7, 2026 |
| Affects | Israeli government, municipalities, energy, transport, tech (300+), UAE (25+) |
| Source | blog.checkpoint.com |
Details
Three waves (March 3, 13, 23) targeting 300+ Israeli and 25+ UAE organizations. Uses Tor for scanning, then pivots to Windscribe/NordVPN IPs geolocated in Israel to bypass geo-restrictions. Also limited targeting in Europe, US, UK, Saudi Arabia. Reported by Check Point.