Microsoft 365 accounts compromised at 79 organizations, no passwords needed
Microsoft 365 accounts compromised via session token replay, bypassing MFA at 79 organizations.
Run Huntress?
Get an email when a reviewed story names Huntress, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
An attacker successfully compromised Microsoft 365 accounts at 79 organizations over a ten-week period by replaying stolen session tokens, bypassing multi-factor authentication. The campaign, tracked between July and September 2026, involved phishing for tokens via fake sign-in pages and device-code phishing, enabling access without needing passwords. Once inside, the attacker manipulated inbox rules to hide communications and registered rogue devices and new MFA methods to maintain persistence.
The lesson from this incident
Full lessonAttackers compromised Microsoft 365 accounts across 79 organizations by stealing and replaying session tokens obtained through phishing, completely bypassing multi-factor authentication. This attack demonstrates that MFA alone is insufficient when session management controls are weak — once a valid token is stolen, the attacker is treated as already authenticated. The threat actor then entrenched themselves by registering rogue devices and new MFA methods, making detection and eviction significantly harder. This matters because it represents a fundamental shift: attackers no longer need credentials or to break MFA, they simply steal the proof of authentication that comes after it.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- SaaS security posture management (SSPM)
Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.