INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Microsoft 365 Accounts Compromised via Token-Spraying Attacks

| 2026-10-23 10:30 LOW HIGH DATA BREACH
JSON
Executive Summary
AI-generated
A widespread business email compromise (BEC) campaign targeted Microsoft 365 environments in an operation that made hundreds of thousands of attempts to access corporate networks around the world, with researchers at Huntress identifying it on October 23, 2026. The attackers used fake sign-in pages, device-code phishing, stolen session tokens and social engineering tactics, which appeared to be setting the stage for BEC attacks. This campaign affected Microsoft 365 accounts of hundreds of thousands of victims worldwide, including those of 79 Huntress customer organizations that were targeted between July and September 2026. The attackers achieved their goal by replaying stolen login tokens from their own machines in automated sign-in attempts against Microsoft 365 services, with at least 200,000 login attempts made and 497 successful sign-ins observed.
Technical Mitigations AI-generated
• Conditional Access Policies (CAP) should require MFA for All Users, All Cloud Apps, and All Client App types, unconditionally. • Revoke sessions and reset passwords immediately if a token replay compromise is suspected. • Perform an audit of Entra devices and MFA methods to identify potential security gaps. • Review inbox rules to identify any changes that may have been made by the attackers.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎September 2026
Threat actors used adversary-in-the-middle (AiTM) attacks to target Microsoft 365 accounts, replaying stolen tokens in automated sign-in attempts against the services.
infrastructure Microsoft 365
What they found was a global campaign which targeted corporate Microsoft 365 environments with adversary-in-the-middle (AiTM) attacks , which allowed the attackers to compromise accounts without the attacker ever needing to steal the passwords associated with them.
The attackers then replayed the stolen tokens from their own machines in automated sign-in attempts against Microsoft 365 services.
Active Compromise Within Minutes These ‘token-spraying’ attacks probed Microsoft 365 environments around the world.
The attackers used this initial access to modify controls around Microsoft 365 environments in an attempt to make future access easier.
organisation AiTM
What they found was a global campaign which targeted corporate Microsoft 365 environments with adversary-in-the-middle (AiTM) attacks , which allowed the attackers to compromise accounts without the attacker ever needing to steal the passwords associated with them.
organisation MFA
Crucially for the attackers, these tokens are generated after the real login page has been legitimately used and any associated multi-factor authentication (MFA) has verified the account.
organisation CAP
“Conditional Access Policies (CAP) can help fill some of the security gaps that MFA can't, as long as they're appropriately implemented.
organisation Entra
If companies suspect a token replay compromise, it is advised that they revoke the sessions and reset the password, perform an audit of Entra devices and MFA methods and review inbox rules to identify if anything has been changed.
‎October 22
Researchers launched an investigation into a series of suspicious "sign-in events" across 79 Huntress customer organizations between July and September 2026.
victims 79 Huntress customer organizations
As detailed in a blog post published on October 22 , researchers launched an investigation following a series of suspicious “sign-in events” across 79 Huntress customer organizations which took place between July and September 2026.
‎between July and September 2026
Threat actors used a token-spraying attack to target Microsoft 365 accounts of 79 Huntress customer organizations between July and September 2026.
victims 79 Huntress customer organizations
As detailed in a blog post published on October 22 , researchers launched an investigation following a series of suspicious “sign-in events” across 79 Huntress customer organizations which took place between July and September 2026.
‎2026/10/23
Threat actors used fake sign-in pages, device-code phishing, stolen session tokens, and social engineering to target hundreds of thousands of Microsoft 365 accounts worldwide.
organisation Huntress
Identified by cybersecurity researchers at Huntress, the campaign used fake sign-in pages, device-code phishing, stolen session tokens and social engineering in attacks which appeared to be setting the stage for BEC BEC attacks .
organisation BEC BEC
Identified by cybersecurity researchers at Huntress, the campaign used fake sign-in pages, device-code phishing, stolen session tokens and social engineering in attacks which appeared to be setting the stage for BEC BEC attacks .
infrastructure Microsoft 365
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise.
A newly uncovered and widespread business email compromise (BEC) campaign targeted Microsoft 365 environments in an operation which made hundreds of thousands of attempts to access corporate networks around the world.
victims 365 Target Accounts
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise.
organisation BEC
A newly uncovered and widespread business email compromise (BEC) campaign targeted Microsoft 365 environments in an operation which made hundreds of thousands of attempts to access corporate networks around the world.
organisation Microsoft
A newly uncovered and widespread business email compromise (BEC) campaign targeted Microsoft 365 environments in an operation which made hundreds of thousands of attempts to access corporate networks around the world.
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise.
A newly uncovered and widespread business email compromise (BEC) campaign targeted Microsoft 365 environments in an operation which made hundreds of thousands of attempts to access corporate networks around the world.
What they found was a global campaign which targeted corporate Microsoft 365 environments with adversary-in-the-middle (AiTM) attacks , which allowed the attackers to compromise accounts without the attacker ever needing to steal the passwords associated with them.
The attackers then replayed the stolen tokens from their own machines in automated sign-in attempts against Microsoft 365 services.
Active Compromise Within Minutes These ‘token-spraying’ attacks probed Microsoft 365 environments around the world.
The attackers used this initial access to modify controls around Microsoft 365 environments in an attempt to make future access easier.
Metrics
victims
365
Target Accounts
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromise.
Metrics
victims
79
Huntress Customer Organizations
As detailed in a blog post published on October 22 , researchers launched an investigation following a series of suspicious “sign-in events” across 79 Huntress customer organizations which took place between July and September 2026.
Intelligence Sources
Infosecurity-Magazine 2026-10-23