A sophisticated cyberattack campaign has exposed serious vulnerabilities in Microsoft 365 security, compromising accounts across 79 organisations within ten weeks. According to cybersecurity firm Huntress, attackers exploited authenticated sessions rather than cracking passwords or directly defeating multi-factor authentication (MFA), raising concerns about enterprise identity protection.
The attackers deployed counterfeit Microsoft login pages through adversary-in-the-middle phishing techniques. Unsuspecting employees entered their credentials and completed legitimate MFA verification. However, the malicious infrastructure intercepted authentication tokens, enabling cybercriminals to impersonate authorised users without repeating the verification process.
Huntress researchers identified 497 successful sign-ins alongside more than 200,000 failed attempts. In one incident, attackers reused a stolen session within approximately four minutes. This rapid exploitation demonstrates how conventional security monitoring can struggle to distinguish legitimate users from criminals operating through authenticated sessions.
Once inside, attackers attempted to establish persistent access by registering unauthorised devices, manipulating authentication methods and creating malicious inbox rules. These techniques could conceal security alerts, facilitate business email compromise and enable fraudulent financial transactions, turning trusted corporate communication channels into instruments of deception.
The incident highlights a fundamental cybersecurity challenge: MFA remains essential, but conventional authentication methods cannot independently guarantee session integrity. Organisations must adopt phishing-resistant passkeys, FIDO2 security keys, conditional access controls, device registration restrictions and continuous monitoring of suspicious authentication activity.
The larger lesson is that enterprise security must evolve from verifying identities once to continuously validating trust. As AI-driven impersonation and automated phishing become increasingly sophisticated, businesses need behavioural analytics, session-risk assessment and rapid incident response. Protecting Microsoft 365 environments now demands an identity-first, zero-trust security strategy that detects compromised sessions before attackers can exploit them.
