A newly discovered business email compromise campaign targeting Microsoft 365 environments made at least 200,000 login attempts against corporate networks worldwide, according to research published October 22 by cybersecurity firm Huntress. The attackers used fake sign-in pages, device-code phishing, stolen session tokens and social engineering in what appeared to be preparation for business email compromise attacks. The investigation began after researchers identified suspicious sign-in events across 79 Huntress client organizations between July and September 2026.
The campaign relied on adversary-in-the-middle attacks that allowed hackers to compromise accounts without ever stealing passwords. Instead, attackers captured login tokens generated after victims legitimately used real login pages and passed multi-factor authentication checks. Out of at least 200,000 login attempts observed, 497 sign-ins succeeded. In many instances, attackers gained access to corporate environments within minutes of stealing the tokens. Once inside, they wiped victims' multi-factor authentication settings and registered their own phones to user accounts, ensuring a simple password reset wouldn't lock them out. Attackers also created hidden email rules that quietly redirected messages from specific contacts out of view, and modified Entra settings to add their own devices as legitimately registered on the network for requesting additional tokens later.
According to Huntress researchers, the stolen tokens proved especially valuable because "whoever holds the token doesn't need to pass MFA again." In at least one observed incident, attackers used a compromised mailbox to send a payroll-related phishing email, though they didn't receive payment from their intended victim. The campaign's global reach and the nature of token-based access mean attackers can easily establish ongoing presence on compromised networks, the report finds.
The attack worked by exploiting a fundamental feature of how authentication systems operate: tokens generated after successful login and multi-factor verification grant access without requiring users to authenticate again. By intercepting these tokens through fake sign-in pages, attackers bypassed password protections entirely. The automated "token-spraying" technique then replayed the stolen credentials from the attackers' own machines against Microsoft 365 services worldwide. This persistence mechanism proved particularly effective because even organizations with strong password policies and multi-factor authentication enabled remained vulnerable once tokens were stolen.
To reduce risk from these campaigns, Huntress recommends implementing Conditional Access Policies that "require MFA (or block) for All Users, All Cloud Apps, and All Client App types, unconditionally." Organizations suspecting token replay compromise should revoke sessions and reset passwords, audit Entra devices and multi-factor authentication methods, and review inbox rules to identify unauthorized changes. The report emphasizes that Conditional Access Policies can address security gaps that multi-factor authentication alone can't close, provided they're properly configured. For enterprises relying on cloud productivity suites, the campaign demonstrates that authentication extends beyond passwords into a broader ecosystem of tokens and device registrations that require active monitoring. Organizations without visibility into token usage patterns may remain exposed even when traditional security controls appear intact.