Token‑Spraying Campaign Hits Microsoft 365 Users in Large‑Scale Business Email Compromise Operation

Security researchers have uncovered a coordinated effort to breach corporate networks by exploiting Microsoft 365 accounts, a move that appears to be part of a broader business email compromise (BEC) campaign. The attackers rely on a combination of phishing emails, stolen authentication tokens and targeted social‑engineering tactics to gain unauthorized access to user mailboxes and internal communications.

The technique at the core of the operation is known as token‑spraying, where malicious actors repeatedly try a limited set of authentication tokens across many accounts in hopes of finding a valid match. Unlike traditional password‑spraying, token‑spraying leverages compromised session tokens that can be reused without triggering typical account‑lockout defenses, making it a stealthier approach for infiltrating cloud‑based services like Microsoft 365.

In the observed incidents, phishing messages were crafted to appear legitimate, often masquerading as internal IT notices or routine service alerts. Recipients who clicked the malicious links were directed to credential‑harvesting pages or to scripts that silently harvested active session tokens from the browser. Those tokens were then reused to log into the victims' Microsoft 365 environments, granting the attackers visibility into email flows, contact lists and, in some cases, the ability to send messages that appeared to originate from trusted corporate accounts.

Experts say the campaign underscores the growing sophistication of threat actors targeting cloud productivity suites, which have become central to daily business operations. The reliance on token‑based authentication, while enhancing user convenience, also expands the attack surface when tokens are not properly protected or revoked after suspicious activity. Organizations that have not yet implemented multi‑factor authentication (MFA) for all users, or that lack robust token‑lifecycle management, are especially vulnerable.

Microsoft has issued guidance urging administrators to monitor for abnormal token usage, enforce MFA, and regularly review sign‑in logs for signs of anomalous activity. Security teams are also advised to adopt conditional access policies that limit token reuse and to educate employees about phishing tactics that aim to harvest authentication data. As the investigation continues, analysts expect further disclosures about the scope of the campaign and may see additional mitigation recommendations from both vendors and industry watchdogs.