Microsoft 365 threat report

Huntress researchers disclosed a widespread token-spraying campaign targeting Microsoft 365 accounts globally. Between July and September 2026, attackers conducted ~200,000 login attempts against 79 organizations, achieving 497 successful sign-ins. Attackers used phishing, adversary-in-the-middle (AiTM) techniques, and stolen session tokens to bypass MFA, then modified Entra settings, created hidden inbox rules, and registered malicious devices to maintain persistence. The campaign prepared infrastructure for business email compromise attacks.

• Widespread Token-Spraying Attacks Target Microsoft 365 Accounts (opens in a new tab)
• Microsoft 365 accounts compromised at 79 organizations, no passw(opens in a new tab)
• ​Microsoft 365 Accounts at 79 Organizations Breached via Stolen (opens in a new tab)
• Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using (opens in a new tab)