A newly uncovered and widespread business email compromise (BEC) campaign targeted Microsoft 365 environments in an operation which made hundreds of thousands of attempts to access corporate networks around the world.
Identified by cybersecurity researchers at Huntress, the campaign used fake sign-in pages, device-code phishing, stolen session tokens and social engineering in attacks which appeared to be setting the stage for BEC BEC attacks.
As detailed in a blog postpublished on October 22, researchers launched an investigation following a series of suspicious “sign-in events” across 79 Huntress customer organizations which took place between July and September 2026.
What they found was a global campaign which targeted corporate Microsoft 365 environments with adversary-in-the-middle (AiTM) attacks, which allowed the attackers to compromise accounts without the attacker ever needing to steal the passwords associated with them.
The attackers achieved this by stealing the login tokens which help to provide access to the account. Crucially for the attackers, these tokens are generated after the real login page has been legitimately used and any associated multi-factor authentication (MFA) has verified the account. That means that whoever holds the token doesn’t need to pass MFA again.
The attackers then replayed the stolen tokens from their own machines in automated sign-in attempts against Microsoft 365 services.
Active Compromise Within Minutes
These ‘token-spraying’ attacks probed Microsoft 365 environments around the world. Researchers at Huntress observed the threat actor behind the campaign make at least 200,000 login attempts, which included 497 successful sign-ins. In many cases, the attackers were inside environments just minutes after stealing the tokens.
The attackers used this initial access to modify controls around Microsoft 365 environments in an attempt to make future access easier.
For example, in several observed incidents, the attackers wiped the victim’s MFA settings and added their own phone to the account user, so a simple password reset wouldn’t lock them out, because now the attacker had their own authenticator app for the environment.
Other methods the attackers used to help maintain persistence on the compromised networks included hidden email rules in victim inboxes that quietly moved messages from specific contacts out of sight. They even modified Entra settings to add their own devices as legitimately registered on the network to request additional tokens if needed in future.
The attackers were also observed using a compromised mailbox to send a payroll-related phishing email message. Using a legitimate email to send these requests increases the likelihood of a business email compromise attack working. In this case, however, it appears the attackers did not receive a payment from their intended victim.
The nature of this campaign means that the attackers can easily establish persistence on the network. But Huntress emphasised that there are actions which can be taken to reduce the risk from these kinds of campaigns.
“Conditional Access Policies (CAP) can help fill some of the security gaps that MFA can’t, as long as they’re appropriately implemented. Businesses setting up CAPs should require MFA (or block) for All Users, All Cloud Apps, and All Client App types, unconditionally,” said Huntress.
If companies suspect a token replay compromise, it is advised that they revoke the sessions and reset the password, perform an audit of Entra devices and MFA methods and review inbox rules to identify if anything has been changed.
