Stolen session tokens used to hijack Microsoft 365 accounts at 79 organizations
Huntress researchers say an attacker replayed stolen Microsoft 365 sessions to break into email accounts at 79 organizations between July and September, bypassing MFA without passwords.
At a glance
- An attacker replayed stolen Microsoft 365 sessions to compromise accounts at 79 organizations between July 14 and September 22, 2026.
- Tokens were captured through adversary-in-the-middle phishing, device-code phishing and social engineering, bypassing MFA.
- The attacker registered rogue devices, replaced MFA methods and created hidden inbox rules for persistence and concealment.
- Researchers urge Conditional Access policies and audits of authenticators, devices and inbox rules.
An attacker compromised Microsoft 365 email accounts at 79 organizations by replaying stolen sign-in sessions, without ever needing the victims' passwords, according to research by Huntress reported by Help Net Security on October 23. The campaign ran from July 14 to September 22, 2026, and researchers counted 497 successful sign-ins alongside more than 200,000 failed login attempts.
What happened
According to Help Net Security, the attacker obtained session tokens in several ways. In adversary-in-the-middle (AiTM) phishing, victims used fake sign-in pages that relayed the real Microsoft login and MFA prompt, capturing the session token issued after MFA was completed. In device-code phishing, victims entered a code on Microsoft's legitimate sign-in page, which handed tokens to the attacker. Social engineering during ordinary logins was also used.
The stolen tokens were then replayed in bulk, mostly from a single IP block, in what researchers compared to password spraying. On September 11, the attacker switched to a new address and ran an automated tool that reused captured tokens, completing hundreds of sign-ins at nearly 30 organizations over four days. Over the course of the campaign, the gap between a victim reaching the MFA prompt and the hijacked session appearing from an attacker address shrank from 12 minutes to four minutes, the report said.
Technical details
The researchers observed several persistence and concealment techniques:
- At least 48 rogue devices were registered with names consisting of
DESKTOP-followed by eight hexadecimal characters. - In 19 organizations, existing MFA methods were wiped and replaced within three hours of the first sign-in; in one case an authenticator labeled
iPhone 13was added less than an hour after the session was hijacked. - Inbox rules with names such as
.,sssandiTdeleted messages or marked them read and moved them out of view. In one case, the attacker emailed a payroll request to an external accountant and created rules to hide the replies.
The replays came from servers at 1337 Services GmbH, a hosting provider incorporated in Hamburg, using six addresses in 193.26.115.0/24 across four phases. Blocking any single address would have stopped at most one phase. Four organizations whose Conditional Access policies refused the sign-ins blocked one address 1,052 times. The report does not attribute the campaign to a named threat actor.
What to do
- Enforce Conditional Access policies that can require MFA or block sign-ins outright, covering gaps that MFA alone leaves open.
- Audit accounts for unauthorized authenticators and registered devices, which survive password resets.
- Review Entra directories and mailboxes for suspicious inbox rules and rogue devices matching the indicators above, and remove them.
- Consult the full indicator list and mitigation guidance published by Huntress.
Sources
- Microsoft 365 accounts compromised at 79 organizations, no passwords needed — Help Net Security
This story is based on the sources listed above. Always check the vendor’s official advisory before acting on critical systems.
