Overview
Multi-factor authentication has become one of the most important controls protecting Microsoft 365 identities. But MFA does not automatically protect the session that exists after authentication has succeeded. A Microsoft 365 campaign observed between July and September 2026 demonstrates the problem. Huntress identified more than 200,000 login attempts across 79 organisations, resulting in 497 successful sign-ins, 97 compromised accounts and at least 48 rogue Entra devices. The attackers were not simply guessing passwords. They were stealing authentication tokens and replaying them from their own infrastructure.
The Attacker Does Not Need to Defeat MFA
The campaign used adversary-in-the-middle (AitM) techniques to place a malicious login page between the victim and legitimate Microsoft authentication services. The victim enters their credentials and completes MFA. The attacker relays the authentication process to Microsoft and captures the resulting session token. That token effectively represents proof that authentication has already taken place. The attacker can then replay the token from another device, sometimes within minutes, allowing access to Microsoft 365 services without having to complete the original MFA process again. Huntress described the technique as token spraying because stolen tokens were replayed at scale across multiple organisations in a manner similar to password spraying. The distinction is important: the attacker is not necessarily breaking MFA. They are stealing the authenticated session that MFA helped establish.
Persistence Starts After the First Successful Login
Once an account was compromised, the attackers attempted to make their access more durable. In at least 19 organisations, existing MFA methods were removed and a new authenticator method was registered within three hours of the initial compromise. In one case, a new authenticator named “iPhone 13” was registered less than an hour after the session was hijacked. The attackers also registered at least 48 unauthorised devices in victim Entra directories. This changes the nature of the incident. A stolen token may eventually expire or be revoked, but a newly registered authentication method or device can provide another route back into the account. The initial session theft is therefore only the beginning of the attack lifecycle.
The Mailbox Becomes Part of the Attack
Compromised accounts were also modified to hide evidence and interfere with business communications. Attackers created obscure inbox rules designed to delete or redirect messages containing terms associated with payroll, deposits and bonuses. In one case, a rule marked incoming messages as read and deleted them. A compromised mailbox was also used to send spam to hundreds of external recipients before Microsoft Entra ID Protection eventually classified the account as high risk. This demonstrates why identity compromise cannot be treated purely as a login problem. Once an attacker controls an account, email becomes both a business communications platform and a security-control bypass mechanism.
Identity Security Must Continue After Authentication
The campaign reinforces the importance of Conditional Access and continuous identity monitoring. Organisations need visibility into more than successful and failed logins. Unexpected MFA registrations, new Entra devices, unusual session locations, new enterprise applications and suspicious mailbox rules can all indicate that an authenticated session has been taken over. Token theft can also originate through multiple mechanisms, including AitM phishing, device-code phishing and social engineering during legitimate authentication. When compromise is suspected, simply changing a password may not be sufficient. Sessions should be revoked, MFA methods reviewed, unauthorised devices removed and mailbox rules and application access audited.
Expert in the Cloud Insight
The traditional identity model often ends with a successful authentication:
Username → Password → MFA → Access
Modern attacks demonstrate that the security lifecycle does not end there.
A more realistic model is:
Identity proof → Token issuance → Session → Device → Application → Privileged action
Every stage represents another opportunity for compromise or persistence.
The most important lesson from this campaign is therefore simple:
MFA proves authentication at a point in time. It does not prove that every subsequent session, device or action is legitimate.
Identity security must therefore move beyond authentication towards continuous validation, session control, device trust and behavioural detection.
Detection is not revocation, and authentication is not the same as continued trust.
Leave a Reply