# Stolen Microsoft 365 Tokens Breached 79 Organizations Without Passwords

- URL: https://usa-24.com/microsoft-365-token-replay-attack/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-24T08:49:52.639Z
- Updated: 2026-10-24T08:49:52.645Z
- Topics: Microsoft 365, Token Replay, Business Email Compromise, Multi-Factor Authentication, Cybersecurity

> A Huntress investigation found attackers reused stolen Microsoft 365 sign-in tokens to break into business email at 79 organizations between July and September, bypassing MFA and passwords.

## Key takeaways

- Huntress tracked the campaign from July 14 to September 22, 2026, and linked it to 79 victim organizations.
- Attackers recorded 497 successful sign-ins against more than 200,000 failed login attempts, according to Huntress.
- Stolen session tokens work because Microsoft issues them after a user completes MFA, so the second factor has already been satisfied.
- The intruders registered at least 48 rogue devices in Microsoft Entra and created hidden inbox rules to conceal mail.
- Huntress advises revoking active sessions first, then resetting passwords and auditing devices, MFA methods and inbox rules.

Attackers broke into business email accounts at 79 organizations this summer without learning a single password. The method was a Microsoft 365 token replay attack. It reused session tokens that Microsoft had already issued to users who had signed in, multifactor authentication included, according to [Huntress](https://www.huntress.com/blog/token-replay-spray). The campaign ran from July 14 to September 22, 2026, and Huntress published its findings on October 22.

Security outlets picked up the research on October 23, and the reason it matters is simple. The method gets around MFA, so any organization that treats MFA as its main defense is exposed. The sources reviewed for this article did not include a Microsoft statement or any law-enforcement action.

## How the Microsoft 365 token replay attack worked

Victims were lured to fake sign-in pages run through adversary-in-the-middle relays. The relays passed the real Microsoft login and MFA prompt through, so the sign-in looked normal to the person typing. After the sign-in finished, the relay kept the session token that Microsoft issued. That token was the attacker's real prize.

Some tokens came by other routes. According to [Help Net Security](https://www.helpnetsecurity.com/2026/10/23/microsoft-365-accounts-stolen-sessions/) and [ID Tech](https://idtechwire.com/huntress-finds-stolen-microsoft-365-sessions-used-across-79-organizations/), attackers also obtained tokens through device-code phishing and social engineering during ordinary logins.

Help Net Security quoted Huntress researchers with a line that sums up the problem: "The Microsoft accounts were compromised without the attacker ever needing a password."

## How token replay differs from password spraying

Password spraying tries a short list of common passwords against many accounts. Token replay skips the guessing. Attackers reuse tokens that Microsoft issues after a user completes MFA, so the second factor has already happened by the time the token is replayed. Huntress calls the bulk version "token spraying," the same approach as password spraying but with stolen tokens.

Earlier Microsoft 365 campaigns relied on password spraying and device-code phishing, according to [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/tokenspraying-attacks-target/). What sets this one apart is its use of stolen tokens and the persistence tactics that followed.

## Why stolen tokens get past MFA

Multifactor authentication checks a person at the moment of sign-in. The session token is what Microsoft hands back once that check passes. A copied token carries proof that the login already succeeded, so the attacker never has to face the second factor. That is why organizations that rely on MFA as their main defense are exposed.

For defenders, the practical consequence is that a completed MFA prompt no longer proves a session is safe. A session token is a credential in its own right, and it needs the same scrutiny as a password.

The ten-week window also gave the attacker room to build persistence before anyone pulled the thread. USA 24 has reported that a [Florida DMV breach was traced to a police login](https://usa-24.com/florida-dmv-data-breach-police-login/), another case where one valid account was the way in.

## Which organizations were hit and where the traffic came from

Huntress tracked the activity from July 14 to September 22, 2026, and linked it to 79 victim organizations. The key figures are:

- Campaign window: July 14 to September 22, 2026, about ten weeks
- Victim organizations: 79
- Successful sign-ins: 497
- Failed login attempts: more than 200,000
- Rogue devices registered in Microsoft Entra: at least 48

The 79 figure is not a full census. Huntress responded to related incidents at 79 organizations, and the count covers its own customers and those incidents, so the true total is unknown. Infosecurity Magazine describes the campaign as global, but the sources reviewed did not break victims down by country. The share of US victims was not stated.

Most of the replayed tokens came from one block of IP addresses tied to 1337 Services GmbH, a hosting provider incorporated in Hamburg. Huntress says that link identifies the servers the attacker used, not that the hosting firm took part. The operator remains unidentified.

Any organization running Microsoft 365 or Entra ID is in scope. Small and mid-sized businesses without strict conditional access rules face the clearest exposure, and payroll and vendor-payment workflows carry the main fraud risk.

## What the intruder did after getting inside

Once inside, the attacker worked to keep access. According to Huntress and the [Arabian Post](https://thearabianpost.com/token-replay-campaign-breaches-microsoft-365-accounts-at-79-organisations/), the intruder registered at least 48 rogue devices in Microsoft Entra, replaced victims' MFA methods and created hidden inbox rules to conceal mail.

Those steps matter more than the initial sign-in. A registered device and a new MFA method give the attacker a way back in after the stolen session ends. Hidden inbox rules let the attacker watch or redirect mail without the account owner noticing.

The campaign also aimed at business email compromise, a common route to payment fraud. In one incident, a compromised mailbox sent a payroll-related phishing email to an outside contact. According to Huntress and [Mallory](https://mallory.ai/stories/01a1687d-9240-78aa-b83d-9008cd9ff6db), the attempt apparently did not result in payment.

## How to check your Microsoft 365 tenant for token replay

Huntress's guidance splits into checks and response. The steps below combine its advice with the sources reviewed.

1. Review Microsoft Entra ID for registered devices you do not recognize.
2. Check each user's MFA methods for recent additions or changes.
3. Search every mailbox for hidden or forwarding inbox rules.
4. If you suspect compromise, revoke active sessions first, then reset passwords and remove unknown devices and authentication methods.
5. Apply conditional access policies to limit where and how sign-ins can occur.
6. Tell finance staff to verify any payroll or payment-change request by phone. This last step is general advice, not from a specific source.

The order in step four matters. Huntress advises against relying on a password reset alone. The attacker in this campaign held sessions and tokens rather than passwords, so those sessions have to be revoked first.

## What to watch next in the Microsoft 365 campaign

Credential theft is driving other intrusions too. USA 24 has covered a [k0t operation that harvested 70,000 credentials from FortiGate and GlobalProtect](https://usa-24.com/fortigate-credentials-stolen-k0t-campaign/), and [ransomware crews that used a Palo Alto PAN-OS flaw to reach domain credentials](https://usa-24.com/palo-alto-pan-os-ransomware-attacks/). Those cases show what attackers do once they hold valid access: they go after the accounts that control the most.

Three questions remain open. The first is whether Microsoft publishes guidance or changes its defaults, which the sources reviewed did not address. The second is whether independent researchers confirm the 79-organization figure. The third is who runs the operation.

Huntress sells security services, so its numbers come from a vendor with a commercial interest. Outside validation will matter, and so will any new indicators beyond the 1337 Services block and any reports of payment fraud tied to the campaign. For security teams, the lesson is that a valid session can be as dangerous as a stolen password, and defenses should treat it that way.

## Frequently asked questions

### What is a Microsoft 365 token replay attack?

It is an attack that reuses a session token Microsoft 365 issues after a user signs in, so the attacker never needs the victim's password. Huntress says attackers in this campaign obtained tokens through adversary-in-the-middle relays and device-code phishing. They replayed the tokens in bulk, a pattern Huntress calls token spraying.

### Does MFA stop a token replay attack?

Not in this campaign. The attackers captured the session token after the victim completed MFA, so the second factor had already been satisfied. Huntress recommends conditional access policies and session revocation as defenses.

### How do I check whether my Microsoft 365 account was compromised this way?

Review Microsoft Entra ID for registered devices you do not recognize, and check each user's MFA methods for recent changes. Search mailboxes for hidden or forwarding inbox rules, which the attacker used to conceal mail. If you find evidence, revoke active sessions first, then reset passwords and remove unknown devices and authentication methods.

### How many organizations were affected?

Huntress linked the campaign to 79 victim organizations between July 14 and September 22, 2026. That count covers its own customers and related incidents it responded to, so the true total is unknown. The share of US victims was not stated in the sources reviewed.

## Sources

1. [Microsoft 365 accounts compromised at 79 organizations, no passwords needed — Help Net Security](https://www.helpnetsecurity.com/2026/10/23/microsoft-365-accounts-stolen-sessions/)
2. [M365 Token Spray and Replay Campaign Compromises Business Email Accounts — Huntress](https://www.huntress.com/blog/token-replay-spray)
3. [Widespread Token-Spraying Attacks Target Microsoft 365 Accounts — Infosecurity Magazine](https://www.infosecurity-magazine.com/news/tokenspraying-attacks-target/)
4. [Token replay campaign breaches Microsoft 365 accounts at 79 organisations — Arabian Post](https://thearabianpost.com/token-replay-campaign-breaches-microsoft-365-accounts-at-79-organisations/)
5. [Token-Spraying Campaign Targets Microsoft 365 Accounts for Business Email Compromise — Mallory](https://mallory.ai/stories/01a1687d-9240-78aa-b83d-9008cd9ff6db)
6. [Huntress Finds Stolen Microsoft 365 Sessions Used Across 79 Organizations — ID Tech](https://idtechwire.com/huntress-finds-stolen-microsoft-365-sessions-used-across-79-organizations/)