Widespread Business Email Compromise (BEC) Campaign Targets Microsoft 365 Users
A significant and alarming business email compromise (BEC) campaign has recently come to light, targeting Microsoft 365 environments globally. This comprehensive operation involved hundreds of thousands of attempts to infiltrate corporate networks, raising serious concerns about cybersecurity vulnerabilities.
The campaign was initially identified by cybersecurity researchers from Huntress, who detailed their findings in a blog post published on October 22. They discovered that the BEC attacks employed a variety of tactics, including the use of fake sign-in pages, device-code phishing, stolen session tokens, and sophisticated social engineering techniques. These methods were strategically designed to facilitate the implementation of BEC attacks on unsuspecting organizations.
The investigation by Huntress was triggered by a series of suspicious “sign-in events” across 79 customer organizations from July to September 2026. What emerged was a global campaign targeting corporate Microsoft 365 environments through adversary-in-the-middle (AiTM) attacks. This approach enabled the attackers to compromise user accounts without needing to steal associated passwords. Instead, they focused on stealing login tokens, which are critical for accessing accounts, as these tokens are generated after a legitimate login and subsequent multi-factor authentication (MFA) verification.
Crucially, this means that once the attacker obtains the token, they can bypass MFA requirements, gaining near-instant access to the targeted accounts. The technique, known as ‘token-spraying,’ involved the attackers initiating automated sign-in attempts from their own machines, utilizing the stolen tokens against Microsoft 365 services.
Rapid Compromise and Strategic Manipulation
The scale of the attack was staggering. Researchers at Huntress reported observing at least 200,000 login attempts associated with this campaign, of which 497 resulted in successful sign-ins. In many cases, the attackers were able to infiltrate these corporate environments mere minutes after acquiring the tokens. This rapid access allowed them to modify security configurations within Microsoft 365 environments to facilitate future access and maintain persistent entry points.
In numerous incidents, the attackers employed particularly devious techniques to entrench themselves within the victimized environments. They wiped the existing MFA settings and replaced them with their own contact information, ensuring that any password resets would not hinder their access. By installing their own authenticator applications, they were effectively able to retain control over the compromised accounts.
Moreover, the attackers engaged in covert operations designed to enhance their ongoing infiltration. They set up hidden email rules to divert specific messages into obscurity, thereby avoiding detection. In addition, they manipulated Entra settings to register their own devices within the network, enabling them to request further tokens if needed in the future.
One particularly alarming tactic involved using a compromised email account to dispatch a payroll-related phishing message. By sending such requests from a legitimate source, the attackers improved their chances of successfully executing a BEC attack. However, in this instance, they did not obtain any payments from their intended targets.
The persistent and insidious nature of this campaign highlights the vulnerabilities present within corporate networks. In response, Huntress has underscored the necessity for organizations to adopt proactive measures to mitigate the risks posed by such campaigns.
Countermeasures and Best Practices
To bolster defenses against these types of attacks, Huntress recommends the implementation of Conditional Access Policies (CAP). These security measures can address certain gaps inherent to MFA, provided they are properly configured. Businesses should enforce MFA across all users, cloud applications, and types of client applications without exception.
If organizations suspect they have fallen victim to a token replay attack, immediate responses are critical. Companies are advised to revoke all compromised sessions and reset affected passwords without delay. Furthermore, conducting a thorough audit of registered Entra devices and existing MFA methods is essential, along with a detailed review of email inbox rules to reveal any unauthorized alterations.
In conclusion, as cyber threats continue to evolve, the urgency for organizations to strengthen their cybersecurity protocols has become more pronounced than ever. This BEC campaign serves as a stark reminder of the vulnerabilities in corporate networks and the imperative for proactive security measures.