In a chilling demonstration of evolving cyber-adversary tactics, a sophisticated campaign recently targeted Microsoft 365 (M365) environments, successfully compromising 79 organizations without ever requiring a user’s password. By utilizing a technique researchers at Huntress have dubbed "token spraying," the attackers effectively weaponized the very session tokens designed to provide users with seamless access to their cloud resources.

The campaign, which ran from July 14 to September 22, 2026, highlights a critical shift in the threat landscape. As multi-factor authentication (MFA) has become the industry standard for securing accounts, threat actors have moved beyond simple password theft to target the authenticated sessions themselves. This campaign serves as a stark reminder that even the most robust MFA implementations can be rendered obsolete if the underlying session token is intercepted.

The Mechanics of the Breach: Beyond the Password

The primary methodology employed by the attackers involved Adversary-in-the-Middle (AiTM) phishing relays. Unlike traditional phishing, which aims to capture credentials, AiTM attacks position a proxy server between the victim and the legitimate Microsoft login page.

When a user interacts with a malicious link, they are directed to a spoofed interface that mirrors the genuine Microsoft sign-in flow. The proxy relays the user’s input—including the MFA prompt—to the real Microsoft portal in real-time. Once the user successfully completes the MFA challenge, Microsoft issues a session token to the user’s browser. Crucially, because the attacker’s proxy sits in the middle of this transaction, it captures that session token.

Because the token is issued after the MFA step, it serves as a "golden ticket." The attacker does not need to know the password or have access to the user’s secondary authentication device; they simply import the stolen token into their own browser environment to impersonate the victim.

Diverse Vectors of Token Theft

While AiTM relays formed the backbone of the operation, the attackers were opportunistic. Researchers identified that session tokens were also exfiltrated via:

• Device-Code Phishing: Victims were manipulated into entering a legitimate Microsoft device-code onto a spoofed page, granting the attacker access to the session.
• Social Engineering: Manipulating users during standard, day-to-day login procedures to extract or intercept token data.

Chronology of the Campaign: A Ten-Week Onslaught

The Huntress research team mapped a highly disciplined, multi-phased operation that spanned approximately 70 days. The timeline reveals an adversary that was both methodical and resilient, frequently rotating infrastructure to evade detection.

Phase One: Establishing the Foothold (July 14 – August)

The campaign began in mid-July. During this period, the attackers focused on initial reconnaissance and testing their infrastructure. On July 21, researchers observed an account being hijacked and accessed from an IP address associated with the German hosting provider 1337 Services GmbH just 12 minutes after the victim completed their MFA prompt.

Phase Two: Scaling the Spray (August – Mid-September)

By late August, the operation had matured. The attacker transitioned to using an automated program to perform "token spraying." By replaying captured tokens in bulk across various organizations, the attacker mirrored the logic of password spraying, but with a significantly higher success rate, as MFA was already bypassed.

Phase Three: Automation and Evasion (September 11 – September 22)

The final stage of the campaign involved high-velocity automation. Between September 11 and September 15, an automated bot completed hundreds of successful logins across nearly 30 organizations. Throughout this period, the attacker cycled through six distinct IP addresses within the 193.26.115.0/24 subnet. Each time security teams or Microsoft’s automated defenses flagged an IP, the actor simply pivoted to the next, ensuring the campaign remained active despite individual blocks.

Supporting Data: By the Numbers

The scale of this operation is evidenced by the sheer volume of telemetry gathered by Huntress researchers:

• Total Compromised Organizations: 79.
• Successful Sign-ins: 497.
• Failed Login Attempts: Over 200,000, indicating a wide-reaching initial net cast by the attackers.
• Infrastructure: Usage of 1337 Services GmbH in Hamburg, Germany, as the primary relay hub.
• Device Persistence: At least 48 rogue devices were registered within victim directories, typically named using the "DESKTOP-[hexadecimal]" naming convention.
• MFA Persistence: In 19 organizations, the attacker successfully wiped existing MFA methods and replaced them with their own within three hours of the initial breach.

Implications: The Persistence of "Ghost" Access

Perhaps the most alarming aspect of the campaign was the attacker’s focus on maintaining long-term access. Even if a user were to change their password or if the initial session token expired, the attackers had already "baked" themselves into the environment.

The Rogue Device Strategy

By registering their own rogue computers within the Microsoft Entra directory, the attackers ensured they remained authorized users. These devices, appearing as standard Windows machines, often went unnoticed by IT administrators. Since these devices were registered as trusted hardware, they could often bypass subsequent MFA challenges, effectively granting the attacker a "backdoor" into the environment that survived password resets.

The "Silent" Mailbox Strategy

Once inside, the goal was not just theft, but espionage. The attackers implemented malicious inbox rules to hide their tracks. By creating rules named with innocuous characters like ".", "sss", or "iT", they configured the compromised mailboxes to:

1. Automatically delete incoming mail.
2. Move sensitive communications—such as those involving payroll or banking—to obscure folders like "RSS Feeds" or "Conversation History."
3. Intercept and hide replies from external parties (e.g., accountants or vendors) to prevent the victim from realizing a conversation had been compromised.

Official Responses and Security Recommendations

Microsoft Entra ID Protection did independently flag several of the malicious IP addresses utilized in the campaign. However, the sheer agility of the attacker—switching IP blocks and using diverse entry methods—meant that static blocking was insufficient.

Mitigation Guidance

Huntress has provided a comprehensive roadmap for administrators to identify if their environment was targeted. Key recommendations include:

• Audit Entra Directories: Search for unrecognized devices, specifically those following the "DESKTOP-xxxxxxxx" naming convention.
• Review Inbox Rules: Use PowerShell to audit all mail-forwarding and movement rules for every user mailbox. Look for rules that move items to folders like "RSS Feeds" or "Conversation History."
• Conditional Access Policies: The campaign demonstrated that organizations with strict Conditional Access (CA) policies were far more resilient. Policies that enforce compliant devices or restrict access to known, trusted locations proved effective at blocking the attacker’s automated sprays.
• MFA Auditing: Regularly review MFA methods registered to user accounts. Any unrecognized authenticator apps, particularly those labeled with generic device names (e.g., "iPhone 13"), should be immediately revoked.

Conclusion: The New Security Paradigm

The 2026 M365 token-spraying campaign represents a turning point in identity security. The era of believing that "MFA is enough" has officially come to an end. As attackers become more adept at bypassing traditional MFA via session-token theft, the focus of enterprise security must shift toward session management, anomaly detection, and granular Conditional Access.

For IT administrators, the message is clear: monitoring for suspicious logins is no longer sufficient. Organizations must proactively hunt for signs of persistence, such as rogue device registrations and anomalous inbox rules, and shift toward a Zero Trust architecture that treats every session token as a potential point of failure. The "token spray" has shown that in the cloud-first era, the session is the new perimeter, and it must be defended with as much rigor as the password ever was.