[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyTzGkRdGsMYiQDgPlCts17xoMifZ36ayh0iYIHLAtc4":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"e12fba3f-c0d7-40ee-b6fc-3fd4c135731a","Microsoft 365 accounts compromised at 79 organizations, no passwords needed","microsoft-365-accounts-compromised-at-79-organizations-no-passwords-needed-d00a5f","An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress. The researchers tracked the campaign between July 14 and September 22, 2026, counting 497 successful sign-ins and more than 200,000 failed login attempts. The stolen sessions were replayed from servers at 1337 Services GmbH, a hosting provider incorporated … More → The post Microsoft 365 accounts compromised at 79 organizations, no passwords needed appeared first on Help Net Security.","An attacker successfully compromised Microsoft 365 accounts at 79 organizations over a ten-week period by replaying stolen session tokens, bypassing multi-factor authentication. The campaign, tracked between July and September 2026, involved phishing for tokens via fake sign-in pages and device-code phishing, enabling access without needing passwords. Once inside, the attacker manipulated inbox rules to hide communications and registered rogue devices and new MFA methods to maintain persistence.","Microsoft 365 accounts compromised via session token replay, bypassing MFA at 79 organizations.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F23\u002Fmicrosoft-365-accounts-stolen-sessions\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2024\u002F03\u002F25130053\u002Femail-2-1500.webp","2026-10-23T11:45:12+00:00","2026-10-23T15:09:05.849109+00:00",8,[17,20,22,25],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":19},"Microsoft Entra ID Protection",{"name":23,"type":24},"Huntress","vendor",{"name":26,"type":24},"1337 Services GmbH","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":27,"icon":29,"name":30,"slug":31},null,"Threat Intelligence","threat-intelligence",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":27,"icon":29,"name":30,"slug":31},[],[23,26,18],{"controls":48,"vendors":130},[49,78,107],{"slug":50,"name":51,"problem":52,"products":53},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":79,"name":80,"problem":81,"products":82},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":108,"name":109,"problem":110,"products":111},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[112,117,123],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":113,"product_name":114,"url":115,"description":116},"falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":119,"url":121,"description":122},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":125,"url":128,"description":129},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",[131,136],{"slug":132,"name":23,"logo_path":133,"roles":134},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[135],"reported_by",{"slug":63,"name":64,"logo_path":65,"roles":137},[138],"affected",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"session-token-hijacking-bypasses-mfa-at-79-organizations","Session Token Hijacking Bypasses MFA at 79 Organizations","Attackers compromised Microsoft 365 accounts across 79 organizations by stealing and replaying session tokens obtained through phishing, completely bypassing multi-factor authentication. This attack demonstrates that MFA alone is insufficient when session management controls are weak — once a valid token is stolen, the attacker is treated as already authenticated. The threat actor then entrenched themselves by registering rogue devices and new MFA methods, making detection and eviction significantly harder. This matters because it represents a fundamental shift: attackers no longer need credentials or to break MFA, they simply steal the proof of authentication that comes after it.",[144,145,146,147,148,149,150],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 6: Access Control Management","MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-2: Flaw Remediation","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":152,"MITRE ATT&CK T1566: Phishing":153,"NIST SP 800-53 SI-2: Flaw Remediation":154,"CIS Control 6: Access Control Management":155,"CIS Control 17: Incident Response Management":156,"CIS Control 14: Security Awareness and Skills Training":157,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":158},"NIS2 explicitly requires member-state organizations to implement incident handling measures including access control and authentication policies; the failure to detect rogue MFA registrations and token replay over ten weeks represents a clear gap in the mandated security hygiene this article requires.","The initial compromise in this campaign relied entirely on phishing for device-code tokens via fake sign-in pages, which is precisely the technique T1566 documents — organizations with phishing simulation training and anti-phishing technical controls would have reduced susceptibility.","While not a software patch issue, this control's broader mandate to identify and remediate weaknesses in security posture applies — organizations should have identified the architectural weakness of replayable session tokens and remediated it through Conditional Access and token binding policies.","CIS Control 6 requires managing and regularly auditing user access privileges and authentication mechanisms; enforcing phishing-resistant MFA and reviewing rogue device\u002FMFA registrations would have directly prevented attacker persistence in this incident.","The attacker operated undetected for up to ten weeks across 79 organizations, indicating a failure in both detection and incident response; a mature IR process with defined playbooks for token-theft and rogue device registration would have significantly shortened dwell time.","Victims were socially engineered into entering device-code flows on fake pages; regular, targeted training on recognizing device-code phishing and token-harvesting lures would have reduced the likelihood of employees falling for this technique.","This control directly requires organizations to manage session tokens, enforce strong authentication, and ensure only authorized identities can access resources — controls that, if implemented with token binding and Conditional Access, would have invalidated stolen tokens before they could be replayed."]