Your MFA Didn't Fail You, Your Session Did: Inside the 79-Company Microsoft 365 Breach

Employees did everything security training told them to do typed the password, approved the MFA prompt, and attackers walked into their inbox anyway, because this attack never needed to beat MFA at all; it just stole the session that came after it.

For years, the advice small and mid-sized businesses got from their IT provider was simple: turn on multi-factor authentication and most account-takeover risk goes away. A report published this week shows why that advice, while still necessary, is no longer sufficient on its own.

What happened

Cybersecurity vendor Huntress disclosed a campaign, covered by The Hacker News and Help Net Security on October 23 and 26, 2026, in which a single threat actor compromised Microsoft 365 email accounts at 79 organizations between July 14 and September 22, 2026. The numbers are worth sitting with more than 200,000 failed login attempts, 497 successful sign-ins, and 97 user accounts taken over. Not one of those successful logins required guessing or cracking a password.

Instead, the attacker used an adversary-in-the-middle (AiTM) relay, essentially a convincing fake login page that sits between the victim and the real Microsoft sign-in page. The victim types their real password and approves their real MFA prompt, believing they're logging into their own account. In the background, the attacker's relay quietly captures the resulting access token, the digital "pass" that proves a user is already authenticated and reuses it from a server across the Atlantic within minutes. Huntress calls this "token spraying," a nod to how the technique scales the same way password-spraying attacks do, just against sessions instead of credentials.

Once inside, the attackers didn't stop at reading email. In at least 19 of the affected organizations, they removed the victim's existing MFA method and registered their own authenticator app, in one case within 51 minutes of the initial breach, so they could keep getting back in even after the stolen session expired or a password was reset. They also registered at least 48 fraudulent devices directly into victim organizations' Microsoft Entra ID directories and planted hidden inbox rules (with innocuous names like "sss" or ".") that silently deleted or buried emails containing words like "payroll," "deposit," and "bonus" a strong signal that at least some of these intrusions were headed toward business email compromise and wire fraud, not just espionage.

Why this matters more for smaller organizations

Larger enterprises often have dedicated security operations teams watching sign-in logs around the clock. Most small and mid-sized businesses don't which is exactly why MSPs and outsourced IT/security providers exist, and why this story matters to that audience specifically. A technique that requires noticing a new authenticator app, a new registered device, or a buried inbox rule within hours is a technique built to succeed against organizations that check their identity logs occasionally rather than continuously.

It's also a reminder that "we have MFA" is not the same thing as "we're protected." The SANS Institute has been making this exact point in its training curriculum this year: a SANS SEC559 webcast on cloud and hybrid identity security, "Beyond MFA: A Defender's Guide to Token Theft and AiTM," notes that traditional password-plus-one-time-code MFA no longer stops a motivated attacker, and walks defenders through why stolen OAuth and refresh tokens can extend an intruder's access well beyond the original login. SANS points defenders toward a specific, achievable set of controls: phishing-resistant authentication such as FIDO2 security keys or passkeys, Continuous Access Evaluation (which can revoke a session the moment risk is detected, rather than waiting for it to expire), and Conditional Access policies that factor in device compliance and sign-in risk, not just whether a code was entered correctly.

This campaign didn't happen in isolation, either. The same week, researchers also flagged active ransomware exploitation of a critical authentication-bypass flaw in Palo Alto Networks' GlobalProtect VPN (CVE-2026-0257), being used by Qilin-linked affiliates to get into corporate networks without valid credentials at all. The pattern across both stories is the same: attackers are increasingly going around authentication controls rather than through them, which means identity monitoring, not just identity verification, must be part of the plan.

The compliance angle SMBs can't ignore

For businesses operating under a compliance framework, this isn't just a security story, it's an audit story. NIST Cybersecurity Framework 2.0's Protect and Detect functions explicitly call for monitoring authentication and access events, not just enforcing MFA at login. HIPAA's Security Rule requires covered entities and business associates to maintain audit controls and review access to systems holding protected health information. A rogue inbox rule hiding patient billing communications would be very hard to explain in a breach investigation. CMMC 2.0 and the underlying NIST SP 800-171 controls similarly expect organizations to monitor and manage authenticators and session activity, not just issue them. In other words, a business that can show it enabled MFA but never reviews who registered a new device or authenticator afterward has a real gap; one an auditor, a cyber-insurance underwriter, or a breach-notification attorney is increasingly likely to ask about.

What small and mid-sized businesses should actually do

None of this requires an enterprise security budget. A few concrete, affordable steps close most of the gap this campaign exploited:

• Turn on Conditional Access policies (available in most Microsoft 365 Business Premium and above plans) that require a compliant, known device or block sign-in entirely, rather than relying on MFA alone.

• Periodically audit monthly at minimum, which MFA methods and devices are registered on each user account, and immediately investigate anything unrecognized.

• Review inbox rules for hidden or oddly named entries, especially ones involving forwarding, deletion, or moving mail related to finance or payroll.

• Move toward phishing-resistant authentication (security keys or passkeys) for finance, HR, and administrative accounts first, since these are the highest-value targets for business email compromise.

• Treat sign-in log review as an ongoing task, not a one-time setup step as this is precisely the kind of monitoring a managed IT or security provider can take off a business owner's plate.

The bottom line

Multi-factor authentication is still worth having because it stops a huge share of basic attacks. But this week's reporting is a clear signal that the next layer of defense for small and mid-sized businesses isn't a bigger password policy; it's visibility into what happens after someone logs in. Organizations that pair MFA with session monitoring, device audits, and a compliance framework that gets reviewed, not just adopted, are the ones positioned to catch this kind of intrusion in hours instead of months.  

Related Resource