By Global Cybersecurity Desk
Published: October 2026

Main Facts

A newly uncovered, highly coordinated global cyber-espionage and financial crime campaign has targeted corporate Microsoft 365 (M365) environments in an automated operation that launched hundreds of thousands of unauthorized access attempts worldwide. Discovered and analyzed by threat intelligence researchers at cybersecurity firm Huntress, the campaign relied on a lethal combination of deceptive sign-in pages, device-code phishing, sophisticated social engineering, and the theft and reuse of valid authentication sessions.

Rather than relying on traditional credential harvesting—where threat actors attempt to guess or steal account passwords—this operation bypassed passwords altogether. By leveraging Adversary-in-the-Middle (AiTM) proxy frameworks and token-stealing methodologies, the attackers captured valid session tokens generated after a user successfully passed multi-factor authentication (MFA). Armed with these cryptographic keys, the threat actors engaged in high-volume "token-spraying" attacks, successfully breaching nearly 500 enterprise environments within minutes of token acquisition.

The primary objective of the campaign appeared to be setting the stage for lucrative Business Email Compromise (BEC) operations. Once inside the targeted M365 environments, the attackers systematically locked out legitimate administrators by hijacking MFA devices, altering Microsoft Entra ID configurations to register rogue hardware, planting hidden inbox rules to cover their tracks, and ultimately attempting internal lateral phishing for financial gain.

Chronology of the Discovery

The anatomy of this global campaign came to light following a meticulous investigation launched by Huntress researchers in late 2026.

• July – September 2026: Throughout this three-month window, Huntress monitoring systems flagged an anomalous cluster of suspicious "sign-in events" across 79 distinct customer organizations spanning multiple industries and geographical jurisdictions.
• Late September 2026: Security analysts began correlating the unusual telemetry, noting that standard brute-force indicators were absent. Instead, sessions were initiating instantly from disparate global IP addresses using valid, pre-authenticated access tokens.
• October 22, 2026: Huntress officially published its comprehensive threat advisory detailing the "token replay spray" phenomenon, warning the broader enterprise community of a persistent adversary leveraging advanced session-hijacking techniques against cloud infrastructures.

According to the researchers, the timeline from initial token theft to active infrastructure compromise was chillingly compressed. In numerous observed incidents, threat actors infiltrated a corporate network mere minutes after the unsuspecting user completed a fraudulent authentication prompt on a lookalike login portal.

Supporting Data and Technical Mechanics

The technical sophistication of the campaign hinges on how modern cloud security architecture handles session continuity. While organizations have widely adopted MFA to mitigate the risks of weak or leaked passwords, malicious actors have adapted by targeting the sessions established post-MFA verification.

Adversary-in-the-Middle (AiTM) and Token Theft

The attackers utilized AiTM phishing kits positioned between the user and the legitimate M365 sign-in page. When a target fell for the social engineering lure and entered their credentials along with their MFA challenge code, the proxy server relayed the inputs to Microsoft in real-time. Once the authentication was successfully completed, Microsoft issued a legitimate session token to the user’s browser—which was intercepted by the attacker’s proxy.

Because these tokens prove that the user has already satisfied all identity verification requirements (including MFA), any system presenting the token to M365 services is treated as the legitimate owner.

The Scale of Token-Spraying

Huntress observed the threat actor executing automated "token-spraying" scripts from malicious infrastructure. Key metrics from the investigation include:

• 200,000+ total automated login and replay attempts directed at M365 cloud services globally.
• 497 confirmed successful, unauthorized sign-ins across the targeted tenant environments.
• 79 individual customer organizations directly impacted during the core observation window between July and September.

Establishing Persistence

Once inside the compromised M365 tenants, the attackers waste no time cementing their access. Huntress documented several aggressive persistence techniques:

1. MFA Hijacking: Attackers systematically deleted the victimized users’ legitimate MFA methods (such as Microsoft Authenticator or SMS verification numbers) and registered their own rogue phone numbers and authenticator applications. This preemptive lockout maneuver ensured that even if an employee realized their password had been compromised and initiated a reset, the threat actor retained control via alternative MFA tokens.
2. Entra ID Manipulation: The actors modified Microsoft Entra settings to formally register their own devices as trusted corporate hardware, granting them long-term authorization to request fresh tokens whenever necessary.
3. Inbox Evasion Rules: Hidden rules were injected into victim inboxes. These rules silently filtered and swept incoming messages from specific contacts—such as finance departments or external vendors—into obscure folders, effectively blinding the user to security alerts or incoming financial correspondence.

Implications for Corporate Security and BEC Attacks

The ultimate goal of this sweeping campaign was financial extortion through Business Email Compromise. With deep, quiet access to corporate mailboxes, the threat actors monitored internal communications to identify payroll schedules, invoice processing routines, and executive hierarchies.

In at least one observed instance, the attackers utilized a compromised, legitimate executive mailbox to dispatch a highly targeted payroll-related phishing message to internal stakeholders. Because the email originated from a trusted internal account complete with historical context, the risk profile of the phishing attempt skyrocketed. Fortunately, in this specific instance, quick-acting security teams and vigilance prevented any financial payout from being transferred to the attackers.

However, the broader implications are severe. As companies double down on enforcing MFA, threat actors are pivoting heavily toward AiTM phishing and session hijacking. Because these attacks leave traditional credential logs looking normal—showing successful MFA challenges from recognized user profiles—standard Security Information and Event Management (SIEM) alerts often fail to flag the intrusion until the damage is done. Organizations face an urgent need to reevaluate how they monitor post-authentication behavior and session validation.

Official Recommendations and Defensive Countermeasures

While the scope of the campaign is vast and the mechanics difficult to detect using legacy security tools, Huntress and other leading cybersecurity authorities emphasize that enterprises are far from defenseless. Organizations can drastically reduce their risk exposure by deploying targeted hardening policies and strict monitoring protocols.

1. Implement Strict Conditional Access Policies (CAP)

Traditional MFA alone is no longer a silver bullet against AiTM and session replay attacks. Businesses must implement robust, unyielding Conditional Access Policies. Huntress recommends that administrators configure CAPs to explicitly require MFA—or outright block access—for All Users, All Cloud Apps, and All Client App types unconditionally. Furthermore, organizations should restrict session lifetimes and enforce continuous access evaluation (CAE) to force frequent re-authentication checks.

2. Immediate Incident Response Playbook

If an enterprise suspects it has fallen victim to a token replay compromise, swift remediation is critical. Security teams should execute the following steps immediately:

• Revoke Active Sessions: Forcefully terminate all active refresh and access tokens across the affected tenant to instantly sever the attacker’s connection.
• Credential Resets: Immediately force password resets for all impacted accounts.
• Audit Entra Devices: Perform a comprehensive audit of all registered devices within Microsoft Entra ID, removing any unfamiliar or unauthorized hardware entries.
• Review MFA Methods: Inspect user profiles for newly added, unfamiliar phone numbers, authenticator apps, or hardware tokens, and purge unauthorized entries.
• Scrutinize Inbox Rules: Conduct a forensic review of Outlook and Exchange inbox rules to detect hidden forwarding, deletion, or movement rules designed to conceal malicious activity.

As cybercriminals continue to innovate past traditional security perimeters, campaigns like this highlight the necessity of shifting defense strategies from mere perimeter verification to continuous, behavior-based session monitoring and zero-trust cloud architecture.