Proofpoint linked 28 Microsoft 365 tenant intrusions to unrotated service accounts still holding default passwords.