Token-replay campaign compromised 97 Microsoft 365 accounts across 79 organizations
Revoking sessions alone may not evict attackers, because they can swap MFA methods and register rogue devices within hours of signing in.
Huntress has documented a Microsoft 365 campaign in which attackers placed an adversary-in-the-middle relay in front of sign-in pages to harvest credentials, MFA codes and the resulting access tokens, then reused those tokens from their own infrastructure. Between July 14 and September 22, 2026, the firm counted 497 successful sign-ins across 79 organizations, compromising 97 accounts and registering 48 rogue devices in Entra directories. In at least 19 organizations the existing MFA methods were removed and a new authenticator added within three hours of the first login, which makes revoking sessions alone insufficient. Huntress recommends revoking sessions and resetting passwords, auditing Entra devices, reviewing MFA methods and inbox rules, restricting device-code flows, and requiring MFA through Conditional Access for all users and apps.
Why it matters
The campaign shows that stolen sign-in tokens and MFA codes can give attackers durable access to Microsoft 365 directories, not just a single session. Organizations that rely on MFA alone are exposed if attackers can change the authentication methods on an account and keep a device registered for token requests. For anyone following the security of cloud identity systems, the lesson is that a password reset or session revocation is only part of the response; the account's authentication settings and registered devices also need to be checked.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.