Applies to all plans

Huntress, the 24/7 security service that watches over our managed clients’ devices and Microsoft 365 accounts, tracked a 10-week campaign targeting Microsoft 365 email accounts.

How it worked

People were tricked into signing in through a fake login page. The attackers then reused that session to get into Microsoft 365 without needing the password or MFA again. Once in, they:

• registered their own devices
• changed MFA settings
• set up hidden inbox rules to read and forward email quietly

Warning signs

• Unexpected sign-in or MFA prompts
• Emails you didn’t send in your Sent folder
• Messages going missing

If something feels off, tell us straight away. The sooner it’s caught, the less damage an attacker can do.

Tranquil IT monitors for these types of attacks, and we haven’t found any cases of Tranquil IT customers being affected.

Source: Huntress (token spray and replay campaign).