Microsoft 365 Accounts Compromised at 79 Organizations, No Passwords Needed
Help Net Security, Friday, October 23rd, 2026
Huntress tracked an attacker replaying stolen Microsoft 365 session tokens from AiTM and device-code phishing to bypass MFA at 79 organizations.
Huntress tracked a ten-week campaign between July and September 2026 in which an attacker replayed stolen Microsoft 365 sign-in sessions to access mail at 79 organizations.
Tokens came from adversary-in-the-middle phishing pages that relayed the real login and MFA prompt, from device-code phishing and from social engineering, and because session tokens are issued after MFA, holders can reuse them without another prompt.
The attacker used hidden inbox rules to hide mail from victims, operating from a German hosting provider that Entra ID Protection flagged.
The case illustrates why token protection and session monitoring matter alongside MFA.