Huntress observed at least 200,000 automated login attempts against Microsoft 365 environments — including 497 successful sign‑ins — in a global campaign of token-replay operations that ran between July and September 2026, researchers said.
How the attackers used token-spraying and AiTM techniques
Huntress’s investigation found the campaign relied on adversary‑in‑the‑middle (AiTM) techniques that stole session tokens after legitimate sign‑ins had completed. Attackers deployed fake sign‑in pages, device‑code phishing and social engineering to obtain the tokens that Microsoft 365 generates after a user successfully authenticates and completes any required multi‑factor authentication (MFA).
Because the tokens were issued only after MFA verification, anyone holding them could replay the tokens from other machines and access accounts without ever needing the victim’s password or to pass MFA again. Huntress described this behavior as “token‑spraying,” and researchers observed the attackers replay stolen tokens in automated sign‑in attempts against Microsoft 365 services.
Scope and timing: 79 Huntress customers and rapid intrusions
Huntress launched a targeted probe after spotting suspicious “sign‑in events” across 79 customer organizations between July and September 2026. The company recorded at least 200,000 login attempts worldwide, of which 497 resulted in successful sign‑ins. In many cases attackers were inside environments within minutes of token theft, demonstrating the speed and automation of the replay phase.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePersistence mechanisms: MFA wipes, device enrollment, and hidden inbox rules
Following initial access, the attackers took steps to make future access easier and to hide their activity. Observed actions included wiping victims’ MFA settings and adding the attackers’ phone to accounts so the attackers could use their own authenticator app for future challenges. The campaign also modified Entra settings to register the attackers’ devices legitimately on networks, enabling those devices to request additional tokens later.
Attackers also used mailbox configuration changes to conceal activity: hidden inbox rules quietly moved messages from specific contacts out of sight. Huntress reported that a compromised mailbox was used to send a payroll‑related phishing message from a legitimate account — a classic business email compromise (BEC) tactic — though in the observed instance the attackers apparently did not receive a payment from their intended victim.
Mitigations Huntress recommends: Conditional Access Policies and response steps
Huntress stressed practical controls that can reduce the risk these token‑replay campaigns pose. “Conditional Access Policies (CAP) can help fill some of the security gaps that MFA can't, as long as they're appropriately implemented,” the company said. Huntress advised organizations to require MFA (or block) for All Users, All Cloud Apps, and All Client App types, unconditionally, when configuring CAPs.
If an organization suspects a token replay compromise, Huntress recommended a sequence of remediation actions: revoke sessions and reset the account password; audit Entra devices and MFA methods to identify registrations the attacker added; and review inbox rules for hidden or altered rules that could be moving or deleting messages.
What this means for technologists, procurement teams, and end users
- Technologists and security teams should prioritize auditing session activity and Entra device enrollments immediately after detecting suspicious sign‑ins, and implement CAPs that enforce MFA across All Users, All Cloud Apps, and All Client App types, per Huntress’s guidance.
- Procurement and IT leadership who manage Microsoft 365 deployments need to evaluate how their MFA and access policies interact with token issuance and session lifetime, and consider whether current configurations allow token replay to produce rapid, persistent access.
- End users should be aware that legitimate‑looking sign‑in flows and confirmed MFA challenges can still be leveraged by attackers if session tokens are intercepted; spam or payroll requests originating from legitimate accounts may indicate prior compromise rather than simple spoofing.
The campaign documented by Huntress highlights a persistent gap in the protection model: when authentication succeeds, tokens can become the prize, and attackers who harvest them can move faster than many standard defensive controls. The specific recommendation — require unconditional CAP enforcement for All Users, All Cloud Apps, and All Client App types — offers a concrete configuration to harden environments, and the forensic checklist Huntress provides gives a clear response path when token replay is suspected. Whether organizations will apply those controls broadly remains a practical question for Microsoft 365 operators facing this kind of automated, rapid attack.
