Top Highlights
- Scale: Token spraying compromised 97 Microsoft 365 accounts across 79 organizations, using stolen sign-in sessions rather than password guessing.
- Method: AitM phishing relayed credentials and MFA codes to steal tokens, which attackers replayed to access accounts without repeating MFA.
- Impact and persistence: Attackers added rogue MFA methods and Entra devices, and hid or deleted emails to conceal activity and enable mailbox abuse.
Threat, Techniques, and Targets
From July 14 to September 22, 2026, attackers targeted Microsoft 365 accounts at 79 organizations. Huntress recorded more than 200,000 login attempts and 497 successful sign in events. The campaign compromised 97 accounts and added 48 unauthorized Entra devices.
Instead of guessing passwords, attackers used fake sign in pages to capture credentials, MFA codes, and access tokens. They replayed stolen tokens to sign in without completing MFA again. Huntress also traced token theft to device code phishing and social engineering. After gaining access, attackers added authenticator apps, registered devices, and created hidden inbox rules. These rules concealed or deleted messages about payroll, deposits, and bonuses.
Impact, Security Implications, and Remediation
Attackers used compromised mailboxes to hide incoming messages and, in one case, send spam to hundreds of external recipients. In at least 19 organizations, attackers removed existing MFA methods and registered new ones. Therefore, stolen tokens and unauthorized devices could help attackers maintain access.
If an organization suspects a token replay attack, it should revoke sessions and reset affected passwords. It should also audit Entra devices, review MFA methods, inspect inbox rules, and check for unexpected enterprise applications. Additionally, Huntress recommends using Conditional Access policies to require MFA or block access for all users, cloud apps, and client app types.
Expand Your Tech Knowledge
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
