Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
Summary: Huntress observed a Microsoft 365 campaign between July 14 and September 22, 2026, in which an adversary-in-the-middle relay captured sign-in sessions and replayed stolen tokens, producing 497 successful sign-in events from over 200,000 attempts across 79 organizations and compromising 97 accounts. The attackers registered 48 rogue Entra devices and, in at least 19 organizations, removed existing MFA methods and registered a new one within three hours of the first sign-in, including one case where a new authenticator app named "iPhone 13" was activated less than 51 minutes after the session was hijacked.
Bottom line: The attackers never guessed a password: they replayed tokens captured through fake sign-in pages, so MFA was satisfied once and reused, and in one mailbox a hidden rule deleted all incoming mail before the account sent outbound spam to hundreds of external recipients. With 48 rogue devices still sitting in victim directories until someone deletes them, the durable foothold outlasts the stolen session.
Read the original at The Hacker News ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026