Attackers compromised 97 Microsoft 365 accounts at 79 organisations by replaying stolen session tokens, bypassing multi-factor authentication, according to research from Huntress published on 22 October 2026 and reported on 26 October. The campaign ran from 14 July to 22 September 2026, about ten weeks. The method, which Huntress calls token spraying, uses adversary-in-the-middle relay to capture post-MFA session tokens and replay them at scale, within minutes of theft, in a pattern analogous to password spraying but without guessing passwords. The 79 organisations are Huntress customers, not a global Microsoft 365 total, and that scope limit matters: the figures describe what one security firm saw in its own customer base.

Tokens, not passwords, did the damage

The numbers need stating precisely, because they are easy to mix up. Huntress recorded 497 successful Microsoft 365 sign-in events, against more than 200,000 failed login attempts, traced to the 193.26.115.0/24 range, infrastructure associated with German host 1337 Services GmbH. The 497 figure is sign-in events, not accounts: the account figure is 97. Attackers also registered 48 rogue Entra devices, and in at least 19 organisations MFA methods were removed and a new method registered within three hours of the first sign-in. In one case on 21 July, an authenticator app named iPhone 13 was activated under 51 minutes after the hijack.

The figures, stated precisely

No threat actor is named by Huntress or Microsoft, and hosting-provider identification does not imply that the host participated, so this article names none. The practical lesson is narrower and more useful than a name: a stolen session token can sidestep MFA entirely, so defenders should treat unexpected device registrations, MFA method changes and sign-ins from unusual infrastructure as compromise signals in their own right, and revoke sessions and tokens rather than assuming a password reset alone closes the incident.

Sources: The Hacker News (Huntress research) and Infosecurity Magazine.