What Happened
The Hacker News reports Huntress tracked an adversary-in-the-middle campaign from July 14 to September 22. Victims typed their credentials and MFA codes into a fake login page. A relay passed the details to Microsoft in real time and captured the session tokens. The attackers then replayed the stolen tokens at scale, a technique Huntress calls token spraying.
Huntress counted 497 successful sign-ins from more than 200,000 attempts. The campaign compromised 97 accounts at 79 organizations. After entry, the attackers registered 48 rogue Entra devices, added their own authenticator apps, and created hidden inbox rules.
Why This Matters for Canadian Organizations
The report names no Canadian victims, but the technique works against every Microsoft 365 tenant. Canadian municipalities, school boards, clinics, law firms, and small businesses run on Microsoft 365. Many treat MFA as the finish line.
This campaign shows the gap. MFA stops password theft but not session theft. A stolen token works until you revoke it. Rogue devices and extra authenticators let attackers return after you reset a password. Hidden inbox rules let them read mail quietly. A compromised mailbox holding personal information also triggers a PIPEDA breach assessment.
What to Do
Revoke sessions and reset passwords on every suspect account. Audit Entra registered devices, MFA methods, inbox rules, and enterprise app consents. Remove anything you do not recognize.
Restrict device-code flow with Conditional Access. Require compliant devices for sign-in. Move administrators and finance staff to phishing-resistant MFA such as FIDO2 security keys or passkeys. Report confirmed incidents to the Canadian Centre for Cyber Security. See more in our Trends archive.
