Global Microsoft 365 Environments Targeted in Massive Token-Replay Phishing Campaign

A sophisticated and widespread business email compromise (BEC) campaign has recently come to light, revealing a coordinated effort to infiltrate Microsoft 365 environments on a global scale. Cybersecurity researchers at Huntress have identified an operation that leveraged a combination of advanced social engineering, adversary-in-the-middle (AiTM) techniques, and automated session-token theft to launch hundreds of thousands of unauthorized access attempts against corporate networks. The campaign, which was analyzed in detail by the security firm in a report published on October 22, underscores the evolving nature of digital threats that bypass traditional multi-factor authentication (MFA) safeguards.

The investigation into this malicious activity began after Huntress analysts observed a series of highly suspicious sign-in events across 79 of its customer organizations. These events, occurring between July and September 2026, served as a red flag, prompting a deep-dive analysis into the methods employed by the threat actors. What the researchers discovered was a campaign that relied on a highly effective, albeit technically complex, method of bypassing the very security measures organizations rely on to protect their cloud-based infrastructure. By utilizing AiTM phishing pages, the attackers were able to intercept session tokens—small pieces of data that confirm a user’s identity—after the victim had successfully navigated their login process and completed their MFA verification.

The Mechanics of Token-Replay Attacks

In a typical cloud login scenario, MFA is designed to be the final hurdle. A user provides a username and password, followed by a secondary verification step—such as a push notification or a time-based one-time password (TOTP). Once this is successful, the service provider issues a session token. This token acts as a "golden key" that allows the user to access the environment for a set duration without having to re-authenticate at every turn.

The threat actors behind this campaign exploited this fundamental mechanism. By deploying deceptive sign-in pages that mimicked legitimate Microsoft portals, they were able to trick users into providing their credentials. Crucially, the AiTM infrastructure acted as a transparent proxy between the victim and the actual Microsoft login page. The attackers captured the session tokens generated by the service after the legitimate authentication process was completed. Because the attackers possessed these tokens, they could "replay" them from their own infrastructure, effectively impersonating the user without ever needing to know the victim’s password or bypass MFA prompts themselves.

The scale of this operation is significant. Researchers observed at least 200,000 automated login attempts, resulting in 497 confirmed successful sign-ins. This volume of activity highlights a highly automated "token-spraying" strategy that allowed the attackers to cast a wide net across diverse corporate environments simultaneously. Once a token was successfully harvested, the speed of the follow-up action was alarming; in many observed cases, the threat actors managed to gain a foothold within the victim’s environment just minutes after the initial theft.

Establishing Persistence and Escalating Access

Once inside these compromised environments, the attackers did not remain passive. Instead, they focused on securing their foothold and expanding their control. A primary objective appeared to be the manipulation of existing security controls to ensure long-term access, even if the victim later changed their password.

In several instances, researchers observed the attackers actively modifying Microsoft 365 security settings. A common tactic involved the removal of the victim’s existing MFA registration and the addition of the attacker’s own device. By registering their own authenticator application, the attackers effectively locked the legitimate user out of their own account recovery processes, ensuring that a standard password reset would be insufficient to evict them from the system.

Beyond tampering with authentication methods, the threat actors employed various stealthy techniques to maintain persistence. One such method involved the creation of hidden email rules within the compromised inboxes. These rules were configured to automatically move incoming messages from specific contacts—often those related to finance or payroll—to obscure folders, effectively hiding the attacker’s movements from the mailbox owner. Furthermore, the attackers modified settings within Microsoft Entra to register their own malicious devices as legitimate components of the corporate network. By doing so, they could request additional tokens in the future, creating a self-sustaining cycle of access that was difficult for standard security monitoring tools to detect.

The ultimate goal of this activity became clear when researchers observed the attackers utilizing a compromised mailbox to distribute payroll-related phishing emails. By leveraging a legitimate, compromised account, the attackers significantly increased the credibility of their outreach, making it far more likely that other employees or external partners would trust the fraudulent requests. While there were no immediate reports of successful financial exfiltration in the instances reviewed by Huntress, the potential for significant business email compromise was clear, as the attackers were positioned to intercept sensitive financial communications and redirect payments.

Mitigating the Risk of Token-Based Threats

The nature of this campaign demonstrates that even robust security measures like MFA are not immune to sophisticated interception techniques. However, the researchers at Huntress emphasize that organizations are not powerless. The key to defending against token-replay and AiTM attacks lies in a layered approach to security, starting with the strict implementation of Conditional Access Policies (CAP).

For businesses utilizing Microsoft 365, CAPs offer a way to enforce security requirements based on the context of a login attempt, such as the user’s location, the device’s health, or the type of application being accessed. Huntress recommends that these policies be configured to require MFA or to block access entirely for all users, all cloud applications, and all client app types, without exception. By removing the "all-access" nature of session tokens, organizations can force re-authentication in higher-risk scenarios, thereby limiting the utility of a stolen token.

In the event that an organization suspects it has been a target of this campaign, a structured response is required. The first priority is to immediately revoke all existing active sessions for the affected user to invalidate any currently held tokens. Simultaneously, a full credential reset is necessary to prevent further unauthorized logins. Following these immediate remediation steps, security teams should conduct a thorough audit of their Entra environment. This includes checking for any unauthorized devices that have been registered, reviewing MFA methods to ensure only legitimate devices are present, and scrutinizing inbox rules for signs of tampering.

The discovery of this campaign serves as a stark reminder of the sophisticated tactics currently being deployed against corporate cloud environments. As attackers move beyond simple credential theft to more nuanced methods of session hijacking, the security community must continue to adapt, prioritizing visibility into account activity and moving toward a more resilient, context-aware security posture. The rapid response from researchers and the clear guidance on remediation provide a blueprint for organizations looking to secure their digital perimeters against these persistent and evolving threats.