Token-Spraying Attacks on Microsoft 365: Why MFA Alone Is Not Enough

Security researchers have identified a coordinated campaign targeting Microsoft 365 accounts using a technique known as token spraying, according to Infosecurity Magazine. The campaign uses a combination of phishing, stolen session tokens and social engineering to gain persistent access to corporate email environments, with the ultimate goal of enabling business email compromise. What makes this technique particularly significant is that it bypasses multi-factor authentication entirely — not by breaking MFA, but by stealing the session token that is issued after a successful MFA-authenticated login. Once an attacker holds a valid session token, they can access the account as if they were the legitimate user, without needing to repeat the authentication process.

Why this matters for UK organisations

Microsoft 365 is the dominant productivity and email platform across UK business, and business email compromise is consistently one of the most financially damaging cyber threats affecting UK organisations, with losses running into millions of pounds annually across sectors including legal, finance, property and professional services. The widespread adoption of MFA has been a meaningful defensive improvement, but this campaign is a clear reminder that MFA is a layer of defence rather than a complete solution. Token theft typically occurs through adversary-in-the-middle phishing pages that proxy the authentication flow in real time — the user completes their MFA challenge legitimately, but their session token is captured before it reaches the genuine service. This means that user awareness training alone is not sufficient; the technical controls around session management and access policy need to be reviewed alongside it.

What to review

UK organisations using Microsoft 365 should review their conditional access policies to ensure that access is restricted based on device compliance, network location and risk signals rather than authentication alone. Session token lifetime settings should be assessed to confirm that tokens expire appropriately and cannot be reused across different network contexts. Security teams should be actively monitoring Entra ID sign-in logs for anomalous patterns such as logins from unexpected geographic locations, unfamiliar devices or unusual access times. Where continuous access evaluation is available, enabling it adds an additional layer of protection by allowing token revocation in near real time. Reviewing these controls now, before an incident occurs, is significantly more straightforward than investigating a compromise after the fact.

Source: Infosecurity Magazine