A security firm has reported a ten-week campaign that broke into Microsoft 365 accounts at 79 organisations, and the attackers did not need anyone’s password to do it.
What happened
According to a report from 4sysops on research by security company Huntress, the attackers used a technique called “token spraying”. Instead of guessing or stealing passwords, they replayed sign-in sessions – the digital “you are already logged in” pass your computer holds after you sign in. Huntress counted 497 successful sign-ins out of more than 200,000 attempts.
Once inside, the attackers worked to stay there. They registered their own devices against the accounts, replaced the victims’ multi-factor authentication (MFA) methods with their own, and set up inbox rules to hide emails from the real account owners.
Why it matters for your business
Many small businesses treat MFA as the finish line. It is still essential, but this campaign is a reminder that a stolen session can get past the login screen entirely. And hidden inbox rules are a classic setup for invoice fraud: an attacker quietly reads your email, then sends a convincing “our bank details have changed” message to your customers or suppliers.
What to check this week
- Inbox rules: ask staff (or your IT provider) to look for rules they did not create, especially ones that move, delete or forward mail.
- MFA methods: check that each person’s registered phone numbers and authenticator apps are actually theirs.
- Registered devices: review the devices listed against your Microsoft 365 accounts and remove any you do not recognise.
- Sign out everywhere: if anything looks wrong, revoke all sessions and reset the account, not just the password.
- Sign-in alerts: make sure someone is actually reviewing unusual sign-in warnings from Microsoft.
None of these checks takes long, and they can be the difference between a quiet fix and a costly fraud.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.