A new, large-scale business email compromise (BEC) campaign targeted Microsoft 365 environments using token-spraying techniques to access corporate accounts without the attackers needing passwords. Researchers from Huntress identified the operation after a spike in suspicious sign-in events across 79 organisations between July and September 2026.
The attackers used adversary-in-the-middle (AiTM) phishing and token replay to access cloud services, stealing login tokens that are generated after a legitimate login and MFA verification. Those tokens allow automated sign-ins, meaning the holder doesn’t have to pass MFA again, enabling rapid penetration into victim networks.
Huntress observed the threat actor behind the campaign making at least 200,000 login attempts, with 497 successful sign-ins, frequently establishing inside access within minutes of token theft. Once inside, the attackers sought to entrench persistence by modifying controls, such as wiping MFA settings and adding their own device to the account’s authenticator, so a password reset would not easily revoke access.
They also employed tactics like hidden email rules to move messages and even altered Entra settings to register devices for future token requests. In some instances, compromised mailboxes were used to send payroll-related phishing emails, increasing the chance of successful BEC activity; in the reported cases, payments were not obtained.
The researchers advise defensive steps including robust Conditional Access Policies (CAP) and unambiguous MFA requirements for all users, apps and client types, plus session revocation, password resets, and auditing of Entra devices, MFA methods and inbox rules to detect changes.