Microsoft 365 token-replay campaign compromises 97 accounts across 79 organizations despite MFA

Huntress detailed a Microsoft 365 adversary-in-the-middle campaign that ran from July to September, capturing sign-in sessions behind fake login pages and replaying the stolen tokens from attacker devices within minutes, a technique it calls token spraying. From over 200,000 login attempts the attackers achieved 497 successful sign-ins, compromised 97 accounts across 79 organizations, and registered 48 rogue Entra devices. In at least 19 organizations they removed existing MFA methods and registered their own within three hours, and planted hidden inbox rules hiding payroll and deposit emails. Defenders should revoke sessions, audit Entra devices and MFA methods, and restrict the device-code workflow with Conditional Access.

Check

Hunt Microsoft 365 for rogue Entra device registrations, unexpected MFA-method changes, and hidden inbox rules, and revoke sessions for any suspected compromise.

Affected

Microsoft 365 users phished through an adversary-in-the-middle page have their post-login tokens replayed from attacker devices, bypassing MFA without reusing the password.

Fix

Reset credentials and revoke sessions, audit Entra devices and MFA methods, block legacy device-code flows with Conditional Access, and require MFA for all users and apps.