Nice2GeekYou

Stolen Microsoft 365 Sign-Ins Hit 79 Organizations, No Password Needed — Check Your Inbox Rules

Security firm Huntress tracked attackers breaking into Microsoft 365 accounts at 79 organizations by stealing the sign-in session after MFA, then hiding payroll and banking emails with tiny inbox rules. Here's what a small business should check this week.

  • microsoft-365
  • email-security
  • business-email-compromise
  • mfa
  • conditional-access
  • payroll-fraud
  • phishing
  • cybersecurity
  • smb
  • managed-it

MFA on your Microsoft 365 email is still essential, but this campaign shows it isn't the whole answer. In a report published October 23, 2026, security firm Huntress said it responded to incidents at 79 organizations where attackers got into Microsoft 365 mailboxes without ever knowing the password. Huntress counted 497 successful sign-ins and more than 200,000 failed attempts between July 14 and September 22.

How it works

The victim clicks a phishing link and signs in on what looks like the real Microsoft page. A relay sits in the middle, passes the real login and MFA prompt through, and keeps the "proof of login" token Microsoft hands out once sign-in is done. Because that token is issued after MFA, whoever holds it doesn't have to pass MFA again. Huntress calls the high-volume version "token spraying."

Once inside, the attackers registered at least 48 fake devices, wiped and replaced victims' MFA methods, and created inbox rules with forgettable names like "s" or "sss." In one case, a rule caught any message mentioning payroll, direct deposit, bank or bonus, and another hid every reply from the company's outside accountant while the attacker emailed that accountant about payroll. That's the setup for a fake direct-deposit change.

What to do this week

  1. Look at inbox rules on every mailbox, especially ones with one- to three-character names, ones that move mail to RSS Feeds or Conversation History, and ones keyed on payroll or banking words.
  2. Check each user's MFA methods and registered devices and remove anything they don't recognize.
  3. If an account looks compromised, revoke its sessions, not just the password. Huntress notes a password reset alone doesn't remove attacker-added devices or MFA methods.
  4. Turn on Conditional Access (Microsoft's sign-in rules for who, where and which devices) and block device-code sign-in if you don't use it. Huntress says these policies blocked a later wave of attempts.
  5. Stop users from approving new third-party apps on their own, and keep a call-back rule for any payroll or bank-detail change: confirm by phone at a number you already have.

Nice2GeekYou is based in San Antonio, serving all of Texas, and our managed IT plans support remote Microsoft 365 clients across the U.S. We can review your tenant's sign-in rules, inbox rules and MFA setup. Request a quote, see our monthly plans, or text us at (210) 504-8969.

Sources: Huntress — M365 Token Spray and Replay Campaign Compromises Business Email Accounts (Oct 23, 2026); Help Net Security — Microsoft 365 accounts compromised at 79 organizations, no passwords needed (Oct 23, 2026).