Token-spraying campaign hits Microsoft 365 accounts for email fraud
Original title: Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise
Huntress counted at least 200,000 login attempts and 497 successful sign-ins from July to September 2026.
Huntress says a global business-email-compromise campaign used adversary-in-the-middle pages, device-code phishing, and stolen session tokens against Microsoft 365. Tokens captured after legitimate login and MFA were replayed, often within minutes, across customers investigated after suspicious sign-ins at 79 organizations. Attackers reset MFA to their own phones, hid inbox rules, registered devices in Entra, and sent at least one payroll phishing message that did not result in payment.
Unconfirmed: The operators are not named, and only one payroll lure is described as unpaid.
- Investigation covered suspicious sign-ins at 79 Huntress customers from July to September 2026.
- Stolen tokens bypass MFA because they are issued after verification.
- Attackers wiped victim MFA methods and enrolled their own phone.
- Huntress advises conditional access requiring MFA for all users, cloud apps, and client types.
Impact: Account takeover and attempted payroll fraud via stolen session tokens
| Product | Affected |
|---|---|
| Microsoft 365 | — |
- 1.If token replay is suspected, revoke sessions and reset the password.
- 2.Audit Entra registered devices and MFA methods, and review inbox rules.
- 3.Require MFA, or block access, for all users, cloud apps, and client types.
- ATT&CK
- T1557 Adversary-in-the-MiddleT1528 Steal Application Access TokenT1098 Account ManipulationT1564.008 Email Hiding Rules
- Vendors
- Microsoft
- Products
- Microsoft 365Entra
- Organizations
- Huntress
From the original article
2 min read at infosecurity-magazine.com
Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using phishing, stolen session tokens and social engineering
By Danny Palmer · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.