Token-spraying AiTM campaign hits Microsoft 365 tenants with 200,000+ login attempts, 497 successful, setting up BEC
Researchers at Huntress uncovered a global business email compromise (BEC) staging campaign against Microsoft 365 environments. Between July and September 2026 it affected 79 Huntress customer organizations. The actor used fake sign-in pages, device-code phishing, adversary-in-the-middle (AiTM) techniques and social engineering to steal session tokens issued after a successful MFA check. It then replayed those tokens in automated "token-spraying" logins. Huntress observed at least 200,000 login attempts, 497 of them successful, with attackers often inside tenants within minutes of stealing a token. Huntress published its findings on October 22.
Detalhes técnicos
- Stolen tokens are generated after the legitimate login and MFA verification, so replaying them bypasses MFA and requires no password.
- After access, the attackers wiped victims' MFA settings and registered their own phone or authenticator, so a password reset alone would not evict them.
- They created hidden inbox rules that moved messages from specific contacts out of sight.
- They modified Entra settings to register their own devices as legitimate, allowing them to request new tokens later.
- In one case a compromised mailbox was used to send a payroll-related phishing email; no payment appears to have been received.
- The article names no threat actor, IOCs or CVEs.
Remediação
- Configure Conditional Access Policies to require MFA (or block) for All Users, All Cloud Apps and All Client App types, unconditionally (Huntress).
- If token replay is suspected, revoke sessions and reset the password.
- Audit Entra registered devices and MFA methods.
- Review inbox rules for unauthorized changes.
Linha do tempo
-
Token-spraying AiTM campaign hits Microsoft 365 tenants with 200,000+ login attempts, 497 successful, setting up BEC
ler a análise desta fonte ocultar
Researchers at Huntress uncovered a global business email compromise (BEC) staging campaign against Microsoft 365 environments. Between July and September 2026 it affected 79 Huntress customer organizations. The actor used fake sign-in pages, device-code phishing, adversary-in-the-middle (AiTM) techniques and social engineering to steal session tokens issued after a successful MFA check. It then replayed those tokens in automated "token-spraying" logins. Huntress observed at least 200,000 login attempts, 497 of them successful, with attackers often inside tenants within minutes of stealing a token. Huntress published its findings on October 22.
Technical Details
- Stolen tokens are generated after the legitimate login and MFA verification, so replaying them bypasses MFA and requires no password.
- After access, the attackers wiped victims' MFA settings and registered their own phone or authenticator, so a password reset alone would not evict them.
- They created hidden inbox rules that moved messages from specific contacts out of sight.
- They modified Entra settings to register their own devices as legitimate, allowing them to request new tokens later.
- In one case a compromised mailbox was used to send a payroll-related phishing email; no payment appears to have been received.
- The article names no threat actor, IOCs or CVEs.
Remediation
- Configure Conditional Access Policies to require MFA (or block) for All Users, All Cloud Apps and All Client App types, unconditionally (Huntress).
- If token replay is suspected, revoke sessions and reset the password.
- Audit Entra registered devices and MFA methods.
- Review inbox rules for unauthorized changes.