Hackers Hijack Microsoft 365 Accounts at 79 Orgs Using Stolen Login Tokens

Key Takeaways

• A sophisticated campaign compromised Microsoft 365 accounts at 79 organizations by leveraging stolen login tokens.
• The attackers executed at least 497 successful sign-ins between July 14 and September 22, 2026, bypassing multi-factor authentication.
• The methods included adversary-in-the-middle phishing, device-code phishing, and social engineering, allowing persistent access and hidden mailbox activity.
• Researchers from Huntress identified the campaign, detailing the use of rogue Microsoft Entra devices and replacement of victims’ authentication methods.
• Organizations are strongly advised to revoke sessions, reset passwords, remove unauthorized devices, and implement robust Conditional Access policies.

Hackers Exploit Stolen Tokens to Breach 79 Microsoft 365 Organizations

Cyber adversaries successfully infiltrated Microsoft 365 accounts across 79 distinct organizations by exploiting stolen login tokens. This extensive campaign, active for ten weeks from July 14 to September 22, 2026, resulted in a minimum of 497 authenticated sign-ins. Alongside these successful breaches, the attackers initiated over 200,000 failed login attempts within the monitored environments, indicating a persistent and widespread effort.

Unlike traditional password guessing attacks, this operation focused on capturing and replaying authenticated user sessions. This technique allowed the threat actors to bypass multi-factor authentication (MFA), effectively reusing proof of a user’s prior successful authentication to gain unauthorized access without encountering further MFA challenges.

Researchers from Huntress identified the campaign and published their detailed findings on October 22. Their investigation focused on the mechanics of token theft and subsequent account abuse, rather than attributing the activity to a specific known malware family. A critical component of their tactics involved registering at least 48 unauthorized Microsoft Entra devices and altering victims’ legitimate authentication methods to ensure long-term access.

Multi-pronged Attack Strategy

The attackers employed a combination of sophisticated techniques, including adversary-in-the-middle (AiTM) phishing, device-code phishing, and various social engineering tactics. In the relay-based AiTM attacks, victims were lured to a counterfeit sign-in page. This page then forwarded the user’s login credentials and MFA challenge to Microsoft’s legitimate servers, intercepting and capturing the resulting authenticated session token.

These stolen session tokens were subsequently replayed from infrastructure hosted by the German provider 1337 Services GmbH. Another significant vector observed was device-code phishing. This method, previously documented for its abuse of OAuth device authorization flows, tricks victims into approving an attacker-controlled session while interacting with Microsoft’s official website. Huntress noted a surge in this particular technique during the campaign’s August phase.

The researchers categorized the token replay activities into two distinct toolsets. “Build A” utilized scripted token exchanges through Microsoft Office and Authentication Broker clients, targeting core services such as Microsoft Graph, Exchange Online, and SharePoint. In contrast, “Build B” focused on replaying full browser sessions via OfficeHome. The speed of compromise was alarmingly fast, with account takeover sometimes occurring within minutes of initial authentication. For instance, one July incident saw a 12-minute gap, while a September takeover was completed in just four minutes. Notably, the infrastructure used for capturing relays was separate from the replay hosts, meaning that blocking one component would not automatically neutralize the other.

Persistent Access and Covert Mailbox Operations

A disturbing aspect of the campaign was the attackers’ ability to establish persistence. In 19 organizations, threat actors removed existing MFA methods and registered their own replacements within three hours of their initial successful sign-in. The registration of rogue devices provided an additional persistent foothold. While Huntress did not link this specific campaign to the GhostCode phishing kit, earlier analyses of GhostCode activity underscore the importance of scrutinizing device enrollment during token-theft investigations.

Beyond gaining access, the attackers actively manipulated compromised accounts. They created inbox rules designed to conceal incoming messages, effectively hiding their tracks and preventing victims from noticing unusual activity. One notable incident involved a compromised account sending a payroll-related email to an external accountant, with rules specifically designed to hide banking-related messages and subsequent replies. Other malicious activities included sending spam to hundreds of recipients from compromised mailboxes.

Huntress strongly advises organizations to take immediate action upon suspicion of compromise. This includes revoking all active sessions, initiating password resets for affected users, removing any unauthorized devices and MFA methods, and thoroughly reviewing all inbox rules for suspicious entries. Furthermore, organizations should limit unnecessary device-code authentication flows and meticulously examine any new application permissions granted. The efficacy of robust security policies was highlighted during one wave of the campaign, where Conditional Access policies successfully blocked 1,052 attempts across four organizations, demonstrating the critical value of layered security beyond just MFA.

What You Should Do

• Revoke Sessions and Reset Passwords: Immediately revoke all user sessions and force a password reset for any potentially compromised accounts.
• Remove Unauthorized Devices and MFA Methods: Scrutinize Microsoft Entra (Azure AD) for any unfamiliar or unauthorized devices and MFA registration methods. Remove any found.
• Review Inbox Rules: Conduct a comprehensive audit of all mailbox rules for suspicious entries designed to hide or forward emails.
• Implement Conditional Access Policies: Strengthen Conditional Access policies to restrict access based on device compliance, location, and other contextual factors, especially for high-risk applications.
• Limit Device-Code Authentication: Restrict or carefully monitor the use of device-code authentication flows, as these can be exploited in phishing attacks.
• Audit Application Permissions: Regularly review and audit permissions granted to applications within your Microsoft 365 environment to ensure only necessary access is permitted.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.