A recently disclosed Microsoft 365 attack campaign highlights a growing problem for businesses that rely on cloud email and standard multi-factor authentication alone. According to Huntress, attackers used an adversary-in-the-middle technique to capture user sign-in sessions and replay stolen tokens, allowing them to access Microsoft 365 email accounts at multiple organisations.

For European businesses, the incident matters because Microsoft 365 often sits at the centre of daily operations, including email, calendars, files, approvals and internal communications. When attackers gain access to a mailbox, the risk can quickly extend to invoice fraud, internal impersonation, data exposure and further compromise of connected systems.

What happened

Huntress said it observed the activity between July 14 and September 22, 2026. According to the researchers, the campaign involved an adversary-in-the-middle relay designed to intercept authentication sessions, capture valid session tokens and then replay those tokens to log into Microsoft 365 accounts.

The report states that 97 accounts at 79 organisations were compromised. Based on the information disclosed, the technique did not depend on guessing passwords after the fact. Instead, it targeted the authenticated session itself, which can allow attackers to bypass protections if a valid token has already been issued.

Token replay attacks are particularly concerning because they exploit the trust placed in an active session. In practical terms, a user may complete a sign-in flow, including MFA, but an attacker who captures the resulting session token may still be able to reuse it to access the account.

Why it matters for European businesses

Many SMEs and mid-sized companies across Europe use Microsoft 365 as core infrastructure. That makes identity security a business continuity issue, not just an IT problem. If an attacker gains access to an employee mailbox, they may be able to:

• Read sensitive commercial or financial information
• Send convincing phishing emails from a trusted internal account
• Intercept supplier or customer payment discussions
• Reset or request access to other SaaS platforms linked to that mailbox
• Collect personal data, creating possible GDPR exposure depending on the incident scope

The wider business risk is that session-token theft can weaken the practical protection offered by basic MFA deployments. That does not mean MFA is ineffective; it remains important. But it does mean businesses should review whether their current controls are resilient against modern phishing and session hijacking methods.

For regulated sectors and organisations covered by stricter security obligations, incidents affecting identity systems and business email may also raise reporting, governance and supplier-risk questions. The exact obligations depend on the company, sector and the facts of the incident.

Who may be affected

The campaign is relevant to any organisation using Microsoft 365, especially those with distributed teams, heavy email-based workflows or limited in-house security resources. The following groups may face elevated risk:

• SMEs that depend on Microsoft 365 for core communications but lack advanced identity monitoring
• Finance, procurement and executive teams whose inboxes are valuable for fraud and impersonation
• IT and security teams responsible for authentication policies, conditional access and incident response
• E-commerce and digital businesses where mailbox compromise can affect customer service, order handling and third-party platform access
• Regulated organisations handling sensitive personal, legal, healthcare or financial information

What companies should consider

While the disclosed report focuses on observed attack activity, the business takeaway is clear: organisations should review whether email and identity protections rely too heavily on passwords and standard MFA alone.

• Assess phishing-resistant authentication options such as stronger sign-in methods that are designed to reduce token theft and relay attack risk
• Review conditional access and session controls to limit abnormal sign-ins and reduce the usefulness of stolen sessions
• Monitor sign-in events closely for unusual locations, device patterns, impossible travel and suspicious session reuse
• Harden high-risk accounts first including executives, finance users, administrators and anyone approving payments or handling sensitive data
• Train staff on modern phishing flows so employees understand that realistic login pages and MFA prompts can still be part of an attack
• Prepare mailbox compromise response procedures including session revocation, credential resets, token invalidation, mail-rule review and downstream SaaS checks
• Review data protection impact if email accounts contain personal data, contracts or regulated information

For European businesses, the incident is a reminder that identity has become a primary attack surface. Companies using Microsoft 365 should treat session security, phishing-resistant authentication and sign-in monitoring as operational priorities rather than optional hardening measures.