Threats · 3h ago
Huntress documented a 10-week Microsoft 365 token-replay campaign, from July 14 to September 22, 2026, that compromised accounts across 79 organizations. The attackers used stolen sign-in tokens rather than guessing passwords.
In an adversary-in-the-middle attack, a relay passes a real Microsoft sign-in and multifactor authentication (MFA) prompt to the victim, then captures the token issued after login. That token can be reused without another password or MFA check. Huntress also found rogue Microsoft Entra devices and hidden inbox rules, adding persistence beyond the stolen sign-in.
For organizations using Microsoft 365 and Entra ID, a password reset alone may leave both a replayable session and account-level persistence in place; the campaign shows how mailbox access can outlast password-focused containment.
3 sources covering this story
Microsoft 365 accounts compromised at 79 organizations, no passwords needed - Help Net Security
An attacker used stolen sessions to break into Microsoft 365 accounts at 79 organizations, bypassing MFA and setting up hidden inbox rules
Widespread Token-Spraying Attacks Target Microsoft 365 Accounts
Security researchers identified attempts to access corporate networks which have been linked to a major Microsoft 365-targeted BEC campaign using phishing, stolen session tokens and social engineering
M365 Token Spray and Replay Campaign Compromises Business Email Accounts | Huntress
Huntress tracked a 10-week Microsoft 365 campaign pairing AiTM relays with token replay, rogue Entra devices, MFA tampering, and hidden inbox rules.
Part of the PlainSec briefing for 2026-10-23