The legitimacy of an internal account provides the perfect cover for sending payroll-diverting emails that bypass standard organizational scrutiny. Cybersecurity researchers recently documented an expansive business email compromise operation that targeted over 79 distinct organizations within the Microsoft 365 ecosystem. Spanning the period from July through September 2026, this campaign involved more than 200,000 unauthorized login attempts designed to infiltrate corporate networks and manipulate financial transactions. Unlike traditional phishing efforts that rely on broad-based social engineering, these attackers focused on high-precision account takeovers to facilitate fraud. The scale of the operation suggests a highly automated and well-resourced threat actor capable of managing thousands of concurrent sessions. By exploiting the inherent trust placed in authenticated internal users, the attackers managed to move laterally within environments before security teams could even register a discrepancy. This specific campaign highlights a significant shift in the threat landscape, where the focus has moved from simple credential theft to the sophisticated manipulation of authentication flows to bypass modern security controls efficiently.
The Evolution: Understanding Adversary-in-the-Middle and Token Theft
Building on this foundation, the technical core of these intrusions relies on adversary-in-the-middle tactics which effectively neutralize the protection provided by traditional multi-factor authentication methods. Instead of attempting to guess or brute-force passwords, threat actors utilize sophisticated proxy sites that mirror legitimate Microsoft 365 sign-in pages to deceive users in real-time. When a victim interacts with these fraudulent portals, the attacker’s infrastructure intercepts the communication between the user and the genuine service provider. This allows the adversary to capture not just the username and password, but the critical session token generated after the second factor of authentication is successfully completed. Once this token is obtained, the attacker can replay it from their own device, effectively tricking the cloud service into believing the session is part of a previously verified and trusted connection. This method proves exceptionally dangerous because it requires no knowledge of the user’s secret keys or physical possession of their hardware tokens.
Furthermore, once the initial access was established, the attackers focused on maintaining long-term persistence to ensure they would not be locked out. Researchers observed several tactical maneuvers, including the modification of account security settings where attackers frequently wiped existing multi-factor authentication configurations and registered their own mobile devices or authenticator apps to the compromised accounts. They also tampered with Microsoft Entra settings to register rogue devices as legitimate network assets, bypassing conditional access policies that only allow connections from managed hardware. To hide their tracks, the actors implemented hidden inbox rules that automatically moved specific incoming emails to obscure folders, preventing victims from noticing security alerts or suspicious communications. The ultimate goal was often a business email compromise attack, where the attackers used the compromised mailbox to send payroll-diverting phishing emails, leveraging the legitimacy of the internal account to ensure success and avoid detection.
To counter these sophisticated threats, organizations implemented a series of rigorous defensive measures and proactive remediation strategies throughout the current year. Security administrators prioritized the deployment of phishing-resistant multi-factor authentication, such as FIDO2-compliant security keys, which effectively blocked the interception of session tokens. They enforced strict conditional access policies that required device compliance and geographic verification for every login attempt without exception. In the event of a suspected compromise, teams revoked all active sessions immediately and conducted thorough audits of inbox rules to identify hidden redirection filters. These organizations also utilized advanced behavioral analytics to detect the subtle signs of token replay attacks before significant financial damage occurred. By resetting all user credentials and validating every registered authentication device, they successfully restored the integrity of their communication platforms and hardened their defenses against future identity-based intrusions.
