Token-Spraying Campaign Targets Microsoft 365 Accounts for Business Email Compromise

A widespread campaign targeted Microsoft 365 environments using phishing, stolen session tokens, and automated token replay to compromise accounts and prepare for business email compromise (BEC). Huntress investigated suspicious sign-ins across 79 customer organizations between July and September 2026, observing at least 200,000 login attempts and 497 successful sign-ins. Attackers replayed tokens issued after legitimate authentication and multifactor authentication (MFA), sometimes gaining access within minutes without needing victims’ passwords or another MFA challenge.

Attackers maintained access by changing MFA methods, registering attacker-controlled devices in Microsoft Entra, and creating hidden inbox rules. One compromised mailbox sent payroll-related phishing, although the reported attempt apparently did not result in payment. Huntress recommended comprehensive Conditional Access policies to reduce exposure; suspected compromises warrant session revocation, password resets, and audits of registered devices, MFA methods, and inbox rules, rather than password resets alone.