Token-Spraying Campaign Hits Microsoft 365 Accounts, Bypassing Passwords and MFA

Researchers at Huntress have uncovered a widespread business email compromise (BEC) campaign targeting Microsoft 365 environments around the world. The investigation began after suspicious sign-in events across 79 Huntress customer organisations between July and September 2026. The attackers used fake sign-in pages, device-code phishing, stolen session tokens and social engineering, and appeared to be setting the stage for BEC attacks.

The campaign relied on adversary-in-the-middle (AiTM) techniques, which let attackers compromise accounts without stealing passwords. Instead, they stole the login tokens created after a user signs in on the real page and completes multi-factor authentication (MFA). Because the token already proves the MFA check was passed, whoever holds it does not need to pass MFA again. The attackers then replayed these tokens from their own machines in automated sign-in attempts, a method called token spraying. Huntress observed at least 200,000 login attempts, including 497 successful sign-ins, and in many cases the attackers were inside environments within minutes of stealing a token.

Once inside, the attackers changed account controls to make future access easier. In several incidents they wiped the victim's MFA settings and added their own phone to the account. This meant a simple password reset would not lock them out, because they held their own authenticator for the account.