A lot of small businesses treat multi-factor authentication as the finish line. Turn it on, check the box, move on.
A campaign that researchers at Huntress tracked from July 14 to September 22, 2026 shows why that's not quite true. The attackers compromised 97 Microsoft 365 accounts across 79 organizations — and MFA was on.
What Happened
The attack didn't crack anyone's password. It worked like this:
A fake sign-in page sits in the middle
The victim lands on a page that relays everything to Microsoft's real login. They type their password and approve MFA like normal. Nothing looks wrong.
The page captures the session token
After sign-in, Microsoft issues a token that says "this person already proved who they are." The attacker's page grabs it.
The token gets replayed — fast
The attackers use that token from their own servers, often within minutes. Tokens also came from device-code phishing and social engineering during real logins.
What They Did Once Inside
Getting in was step one. Staying in was the real goal.
Swapped the MFA
In 19 organizations, attackers removed the user's existing MFA methods and added their own within three hours. In one case, a new authenticator was live 51 minutes after the hijack.
Registered fake devices
At least 48 rogue devices were added to victims' Entra directories. They stay there until someone deletes them — a password reset doesn't touch them.
Hid the evidence
Inbox rules with names like "." or "d" quietly deleted or moved emails about payroll, deposits and bonuses.
Used the mailbox
One compromised account sent spam to hundreds of outside addresses. Another sent a payroll-related email to an outside contact.
Why MFA Alone Didn't Stop It
MFA protects the moment of sign-in. It doesn't protect what happens after. If someone steals the token issued once you've signed in, they inherit your session — no password and no MFA prompt required.
MFA is still essential. But the defenses that matter now are the ones that limit how tokens can be stolen and that catch what attackers do in the first few hours after they get in.
What to Check This Week
- Audit Entra registered devices. Delete anything nobody recognizes.
- Review MFA methods per user. Look for authenticator apps people don't remember adding.
- Search for suspicious inbox rules — especially short or blank names, and anything touching payroll or banking terms.
- Review new enterprise applications that nobody approved.
- Restrict the device-code flow with Conditional Access. Most small businesses never use it.
- Apply Conditional Access to all users, all cloud apps and all client app types — require MFA or block, with no exceptions.
- If you suspect compromise: revoke sessions and reset the password, then repeat steps 1–3. A reset alone leaves the rogue devices and MFA methods in place.
Where Phishing-Resistant MFA Fits
Passkeys and FIDO2 security keys are tied to the real Microsoft sign-in page, so a fake relay page can't complete the login. Microsoft has started making passkeys the default in Entra ID this fall. If you're still relying on text-message codes, this is a good reason to plan the move now.
Free Microsoft 365 Tenant Check
We'll check your tenant for the exact things this campaign left behind — rogue devices, unfamiliar MFA methods, hidden inbox rules — and close the Conditional Access gaps.
DM us "M365" on LinkedIn or schedule a free consultation · (646) 791-2137