Between 14 July and 22 September 2026, Huntress detected 497 Microsoft 365 sign-in events across 79 victim organisations in a token-replay campaign, ultimately compromising 97 accounts. The findings were set out in a Huntress report dated 22 October 2026 and covered in the current news cycle on 28 October.

Tokens stolen after login

The attacker replayed sign-in tokens stolen from victims, rather than guessing passwords. Tokens were captured via adversary-in-the-middle relays, device-code phishing and social engineering during a legitimate login; the relay passes the real login page and multi-factor authentication prompt through, then keeps the proof-of-login token issued after authentication.

Rogue devices and hidden rules

Because the token is minted after multi-factor authentication, whoever holds it does not need to pass that check again. On 21 July the gap from the authentication prompt to a hijacked session was 12 minutes, and on 22 September it was 4 minutes. Huntress traced more than 200,000 failed login attempts to the 193.26.115.0/24 IP range, belonging to German hosting provider 1337 Services GmbH, which Huntress notes offers a legitimate IP hosting service.

The attackers registered at least 48 rogue Entra devices. In 19 organisations, victims' existing authentication methods were wiped and a new method registered within three hours of the first sign-in from a campaign address, in one case a new authenticator app labelled iPhone 13 activated less than 51 minutes after the session was hijacked. Attackers also set hidden inbox rules to delete or move mail, including mail mentioning payroll, direct deposit, bank or bonus. Huntress warned that a password reset alone does not remove rogue devices, authentication methods or inbox rules.

Sources: Huntress and The Hacker News.