A sophisticated and widespread business email compromise (BEC) campaign has been identified targeting Microsoft 365 environments on a global scale. The operation, which investigators say involved hundreds of thousands of individual attempts to infiltrate corporate networks, highlights a critical evolution in how threat actors are bypassing modern multi-factor authentication (MFA) protocols. By utilizing advanced techniques such as adversary-in-the-middle (AiTM) phishing and session token theft, attackers have demonstrated the ability to compromise enterprise-grade accounts without ever needing to possess the user’s actual password.
The campaign was brought to light by cybersecurity researchers at Huntress, who initiated a formal investigation after observing a series of anomalous sign-in events across 79 different customer organizations between July and September 2026. The findings, detailed in an October 22 technical disclosure, paint a picture of a highly automated and persistent threat that exploits the fundamental way cloud services manage user sessions.
The Mechanism of Token-Spraying and AiTM Attacks
At the heart of this campaign lies the exploitation of session tokens. In a standard secure authentication flow, a user visits a sign-in page, provides their credentials, and completes an MFA challenge. Once the system verifies these factors, it issues a "session token" to the user’s browser. This token acts as a temporary digital key, allowing the user to remain logged in and access various cloud resources without needing to re-authenticate every time they click a new link.
The attackers in this campaign utilized adversary-in-the-middle (AiTM) tactics to intercept these tokens. By deploying fake sign-in pages that mimic the legitimate Microsoft 365 login portal, the threat actors were able to position themselves between the victim and the actual Microsoft service. When a victim unknowingly provided their credentials and completed their MFA process on the malicious site, the attackers captured the resulting session token in real-time.
Crucially, because the token is generated only after the MFA challenge has been successfully satisfied, the token itself represents an authenticated, "MFA-cleared" state. By replaying these stolen tokens from their own infrastructure, the attackers could gain immediate access to the victim’s account, effectively bypassing the very security measures designed to keep them out. The researchers at Huntress referred to this process as "token-spraying," as the threat actors automated the replay of these stolen credentials against various Microsoft 365 services to maximize their success rate.
Rapid Compromise and Persistent Access
The speed of the operation was particularly concerning for security analysts. Observations from the Huntress investigation indicated that the threat actor behind the campaign launched at least 200,000 login attempts during the three-month period. Of these, 497 resulted in successful, unauthorized access to corporate accounts. In many instances, the time elapsed between the theft of the session token and the attacker’s full infiltration of the environment was measured in mere minutes.
Once inside an environment, the attackers did not simply lurk; they moved quickly to establish persistence and expand their control. A common tactic involved modifying the security configuration of the Microsoft 365 environment to ensure that they could retain access even if the user eventually became aware of the breach. In several documented incidents, the threat actors actively wiped the legitimate user’s existing MFA settings and replaced them with their own. By registering their own devices—often utilizing their own authenticator apps—the attackers ensured that even if a user attempted to reset their password or recover their account, the attackers would still hold the keys to the account through their own configured MFA methods.
Beyond altering authentication settings, the attackers sought to maintain a low profile while operating within the compromised inboxes. Researchers noted that the threat actors frequently implemented hidden email rules designed to move messages from specific, high-value contacts into folders where they would remain unnoticed by the victim. By filtering out communications related to sensitive business processes, the attackers could hide their tracks and monitor ongoing conversations without the victim realizing that their correspondence was being intercepted or redirected.
Furthermore, the attackers manipulated Entra (formerly Azure Active Directory) settings to add their own malicious devices as legitimately registered entities within the corporate network. This effectively provided them with a persistent "authorized" status, allowing them to request additional tokens as needed and maintain a long-term presence within the cloud infrastructure.
Implications for Business Email Compromise
The ultimate goal of this operation appears to be the execution of business email compromise (BEC) attacks. By using a compromised, legitimate mailbox, the attackers could send highly convincing phishing emails to employees, vendors, or business partners. Because the messages originate from a trusted, internal account, the likelihood of a recipient trusting the request—such as a fraudulent request for a wire transfer or a payroll change—is significantly higher than with traditional, external phishing campaigns.
In one specific case observed by researchers, the attackers leveraged a compromised mailbox to send a payroll-related phishing email. While it appears that the attackers were not successful in extracting a payment from that particular victim, the methodology underscores the danger of the approach. When an attacker gains control of a legitimate email thread or account, the standard indicators of a phishing attempt—such as mismatched domains or unusual sender addresses—are absent, making detection extremely difficult for the average user.
Mitigating Token-Based Threats
While the sophistication of this campaign demonstrates the limitations of relying solely on password-based or even traditional MFA security, Huntress emphasized that organizations are not powerless against these threats. The primary defense involves closing the gaps that allow session tokens to be replayed or misused.
"Conditional Access Policies (CAP) can help fill some of the security gaps that MFA can’t, as long as they’re appropriately implemented," the researchers noted in their report. To be effective, organizations should configure their Conditional Access Policies to require MFA or explicitly block access for all users, all cloud apps, and all client app types without exception. By narrowing the scope of what a stolen session token can do, organizations can limit the attacker’s ability to use that token across different parts of the corporate infrastructure.
For organizations that suspect they may have been caught in a token replay compromise, a swift and systematic response is required. The recommended course of action includes immediately revoking all active user sessions to invalidate any stolen tokens currently in the hands of the attacker. Following this, administrators should perform a comprehensive audit of Entra devices and MFA methods to identify and remove any unauthorized entries. A thorough review of inbox rules is also critical, as attackers often leave these rules in place to maintain their access to information even after their initial sign-in has been blocked.
As threat actors continue to innovate, shifting away from password-centric attacks toward session-based exploits, the security community remains focused on evolving defense strategies. The ability of attackers to bypass MFA through token theft marks a significant shift in the threat landscape, necessitating a move toward more granular, identity-centric security policies that do not rely on a single point of failure.
