Huntress reported a Microsoft 365 token-spraying campaign in which attackers replayed stolen session tokens during automated sign-ins. Its investigation covered suspicious activity across 79 customer organizations from July through September 2026; Huntress counted at least 200,000 login attempts, including 497 successful sign-ins.
How stolen session tokens bypassed another MFA prompt
Here, “token spraying” refers to automated sign-in attempts that replay stolen session tokens. Password spraying, by contrast, tries passwords across multiple accounts.
A session token is a credential created after a user signs in. Huntress said the stolen tokens had been generated after a legitimate sign-in and multi-factor authentication (MFA), a check that uses more than one factor to verify identity. Someone holding a stolen token could use it to access that session without repeating MFA.
Elliot Munro’s March 2024 demonstration shows session-cookie theft and replay in a separate Microsoft 365 scenario.
What Huntress reported about the campaign
Huntress described a global campaign targeting Microsoft 365 environments. The reported methods included adversary-in-the-middle (AiTM) phishing, fake sign-in pages, device-code phishing and social engineering. Attackers then replayed stolen tokens in automated sign-in attempts.
The 79 customer organizations were the scope of Huntress’s investigation into suspicious sign-ins. Huntress reported at least 200,000 login attempts, with 497 successful sign-ins.
How attackers tried to maintain access
In several incidents, attackers reportedly changed victims’ MFA settings and added their own phone numbers. Huntress also described attackers registering their own devices in Microsoft Entra and creating hidden inbox rules that moved messages out of sight.
A compromised mailbox was also used to send a payroll-related phishing email. The intended recipient apparently made no payment to the attackers.
What Huntress recommended
For prevention, Huntress recommended configuring Conditional Access Policies to require MFA or block access unconditionally for all users, all cloud apps and all client app types.
After suspected token replay, Huntress recommended revoking sessions, resetting passwords, auditing Microsoft Entra devices and MFA methods, and reviewing inbox rules for unauthorized changes.
