Token-Spraying Attacks Compromise Microsoft 365 Accounts Globally

A newly uncovered business email compromise (BEC) campaign has targeted Microsoft 365 environments, making hundreds of thousands of attempts to infiltrate corporate networks across the globe. Cybersecurity researchers at Huntress identified this widespread operation, which utilized fake sign-in pages, device-code phishing, stolen session tokens, and social engineering techniques to facilitate these attacks.

The investigation, detailed in a blog post published on October 22, was prompted by a series of suspicious sign-in events observed across 79 customer organizations between July and September 2026. The researchers uncovered a global campaign employing adversary-in-the-middle (AiTM) attacks, allowing the attackers to compromise accounts without needing to steal the associated passwords.

The attackers achieved this by stealing login tokens generated after legitimate use of the real login page, which included successful multi-factor authentication (MFA). This means that once the tokens were obtained, the attackers could bypass MFA and replay the stolen tokens from their own machines in automated sign-in attempts against Microsoft 365 services.

During their investigation, Huntress researchers recorded at least 200,000 login attempts, with 497 successful sign-ins. Alarmingly, in many instances, attackers gained access to the environments just minutes after acquiring the tokens. Once inside, they modified controls within the Microsoft 365 environments to facilitate future access.

Tactics Employed by Attackers for Access

For example, in several cases, attackers wiped the victim’s MFA settings and added their own phone numbers to the accounts, ensuring that a simple password reset would not lock them out, as they now had their own authenticator app linked to the environment. Other tactics included creating hidden email rules in compromised inboxes to discreetly move messages from specific contacts out of sight, and modifying Entra settings to register their own devices on the network for future token requests.

The attackers were also observed using a compromised mailbox to send a payroll-related phishing email, leveraging a legitimate email address to increase the chances of success for their business email compromise attempts. However, it appears they did not receive payment from their intended victim in this instance.

How The Scheme Worked

The nature of this campaign allows attackers to establish persistence within the compromised networks. Huntress emphasized that organizations can take proactive measures to mitigate risks associated with such campaigns. They recommend implementing Conditional Access Policies (CAP) to address security gaps that MFA may not cover, advising businesses to require MFA for all users, cloud apps, and client app types unconditionally.

If companies suspect they have fallen victim to a token replay compromise, they should take immediate action by revoking sessions, resetting passwords, auditing Entra devices and MFA methods, and reviewing inbox rules for any unauthorized changes.