Hackers Compromise Microsoft 365 Accounts at 79 Organizations Using Stolen Session Tokens

Cybercriminals compromised Microsoft 365 accounts across 79 organizations by stealing and reusing authenticated session tokens, according to a report published by Huntress on October 22, 2026.

The campaign recorded at least 497 successful sign-ins between July 14 and September 22, 2026. Researchers also observed more than 200,000 failed login attempts across monitored customer environments during the same period.

Rather than relying solely on password guessing, the attackers focused on stealing valid authentication sessions and replaying them to access victims' accounts. This technique can allow criminals to bypass the need to complete a fresh multi-factor authentication (MFA) challenge when the stolen session remains valid.

Huntress documented a combination of adversary-in-the-middle (AiTM) phishing, device-code phishing, and social engineering techniques. The attackers also registered at least 48 unauthorized Microsoft Entra devices and replaced victims' authentication methods to help maintain access.

The findings highlight a significant security risk for organizations that depend on Microsoft 365 for email, collaboration, document sharing, and business operations.

How Hackers Hijacked Microsoft 365 Accounts

The attackers used several techniques to obtain authenticated sessions and gain access to Microsoft 365 accounts.

One of the primary methods involved adversary-in-the-middle phishing. In these attacks, victims are directed to fraudulent sign-in pages that relay authentication requests to Microsoft's legitimate services.

When a victim enters their credentials and completes an MFA challenge, the phishing infrastructure can capture the resulting authenticated session. Attackers can then attempt to reuse the stolen session token to access the account without repeating the original authentication process.

This explains why MFA alone may not prevent every account takeover. Although MFA adds an important layer of protection, session theft can undermine it when attackers obtain a usable authenticated session.

Researchers traced replay activity to rented infrastructure operated through German hosting provider 1337 Services GmbH. The infrastructure used to capture authentication sessions was separate from the systems used to replay them, meaning that blocking one part of the operation would not necessarily disrupt the entire campaign.

Device-Code Phishing Adds Another Attack Path

The campaign also used device-code phishing, a technique that abuses legitimate device authorization workflows.

In a typical attack, criminals persuade a victim to enter an attacker-controlled device code on Microsoft's legitimate sign-in page. If the victim approves the request, the attacker may obtain an authenticated session associated with the authorization.

Unlike conventional phishing, this method does not always require the victim to enter their credentials on a fake website.

Huntress observed device-code phishing during an August wave of the campaign. The technique demonstrates how attackers can abuse legitimate authentication processes through social engineering rather than exploiting a software vulnerability.

Two Toolsets Used to Replay Stolen Sessions

Huntress identified two distinct toolsets involved in the session-replay activity.

Build A used scripted token exchanges involving Microsoft Office and Authentication Broker clients. The activity targeted services including Microsoft Graph, Exchange Online, and SharePoint.

Build B replayed browser sessions through OfficeHome, providing another route for using stolen authentication sessions.

The researchers also documented how quickly attackers moved from authentication to account takeover. In one July incident, the gap was just 12 minutes. During the final September takeover described in the report, the interval was only four minutes.

These short timeframes illustrate why delayed incident detection can give attackers an opportunity to change account settings, establish persistence, or access sensitive business information.

The separation between session-capture infrastructure and replay systems also complicates detection. Security teams may need to correlate phishing activity, unusual sign-ins, and suspicious network connections to identify the full scope of an attack.

Unauthorized Devices and MFA Changes Helped Attackers Maintain Access

Stealing a session token can provide initial access, but attackers may also attempt to establish additional ways to return to a compromised account.

In 19 organizations, the attackers removed existing MFA methods and registered replacement methods within three hours of their first campaign-linked sign-in.

Huntress also observed at least 48 rogue Microsoft Entra device registrations associated with the campaign.

Unauthorized device enrollment and unexpected authentication-method changes are important warning signs because they can indicate that an attacker is attempting to maintain access beyond the original stolen session.

Organizations should investigate unfamiliar devices, unexpected MFA registrations, and authentication-setting changes, especially when they occur shortly after suspicious sign-ins.

Although other phishing campaigns have abused device enrollment and authentication workflows, the findings presented by Huntress do not establish that this operation was linked to a specific phishing kit or malware family.

Attackers Used Inbox Rules to Hide Malicious Activity

The campaign extended beyond account access. Attackers also modified mailbox settings to conceal incoming messages and support further fraudulent activity.

In one documented incident, a compromised account sent a payroll-related email to an external accountant. The attackers also created inbox rules that concealed banking-related messages and replies.

Other observed activity included sending spam to hundreds of recipients.

These actions can make account compromise more difficult to detect. If attackers hide replies or redirect attention away from financial correspondence, employees may not immediately notice unauthorized activity.

For businesses, the potential consequences include fraudulent payment requests, exposure of sensitive communications, business email compromise, and reputational damage.

Security teams should therefore investigate mailbox rules, message forwarding settings, sent items, and unusual outbound email activity whenever a Microsoft 365 account is suspected of being compromised.

How Organizations Can Protect Microsoft 365 Accounts

The campaign highlights the importance of combining MFA with session protection, identity monitoring, and rapid incident response.

Huntress recommends revoking active sessions, resetting passwords, removing unauthorized devices and authentication methods, and reviewing suspicious inbox rules.

Organizations should also consider the following defensive measures:

• Revoke compromised sessions: Invalidate active sessions associated with affected accounts to limit continued use of stolen authentication tokens.
• Reset exposed credentials: Change compromised passwords and investigate whether attackers have modified recovery or authentication settings.
• Remove unauthorized devices: Review Microsoft Entra device registrations and remove unfamiliar or suspicious enrollments after verifying they are not legitimate.
• Audit MFA methods: Check for unexpected authentication-method registrations, removals, or replacements.
• Review mailbox configurations: Inspect inbox rules, forwarding settings, sent messages, and suspicious communications with external recipients.
• Restrict device-code authentication: Limit unnecessary use of device authorization flows where supported by organizational policies and business requirements.
• Strengthen Conditional Access: Apply appropriate access policies based on user, device, session, and sign-in risk.
• Monitor application permissions: Investigate unexpected application consent grants and permissions that could provide continued access to organizational data.

During one campaign wave, Conditional Access blocked 1,052 attempts across four organizations, according to Huntress. This finding illustrates how access policies can provide an additional layer of defense beyond MFA alone.

Organizations should also ensure that incident-response procedures cover token theft, unauthorized device enrollment, mailbox manipulation, and suspicious authentication activity.

Conclusion

The Microsoft 365 campaign investigated by Huntress shows how cybercriminals can exploit stolen session tokens to compromise accounts without repeatedly entering passwords or completing new MFA challenges.

By combining adversary-in-the-middle phishing, device-code phishing, unauthorized device registration, and mailbox manipulation, attackers gained access to accounts across 79 organizations and attempted to maintain their foothold.

For defenders, the lesson is clear: protecting Microsoft 365 accounts requires more than passwords and MFA. Session revocation, Conditional Access, device monitoring, authentication-method audits, and mailbox-rule investigations are all important parts of a strong identity security strategy.

Organizations that detect suspicious authentication activity early and respond quickly can reduce the opportunity for attackers to maintain access, misuse business email, or expose sensitive information.