Stolen Microsoft 365 tokens opened accounts across 79 organizations
Huntress documented a 10-week Microsoft 365 token-replay campaign, from July 14 to September 22, 2026, that compromised accounts across 79 organizations. The attackers used stolen sign-in tokens rather than guessing passwords.
In an adversary-in-the-middle attack, a relay passes a real Microsoft sign-in and multifactor authentication (MFA) prompt to the victim, then captures the token issued after login. That token can be reused without another password or MFA check. Huntress also found rogue Microsoft Entra devices and hidden inbox rules, adding persistence beyond the stolen sign-in.
For organizations using Microsoft 365 and Entra ID, a password reset alone may leave both a replayable session and account-level persistence in place; the campaign shows how mailbox access can outlast password-focused containment.
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts
Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using phishing, stolen session tokens and social engineering