A successful login does not always mean an account is safe. Cybersecurity researchers have identified a campaign targeting Microsoft 365 users in which attackers stole authenticated session tokens and reused them to access corporate accounts, bypassing the need to complete multi-factor authentication again.
According to reporting by The Hacker News on October 26, 2026, security firm Huntress observed the activity between July 14 and September 22, 2026. The campaign affected 97 accounts across 79 organizations, with 48 unauthorized devices registered in Microsoft Entra ID directories.
Researchers also identified 497 successful Microsoft 365 sign-in events among more than 200,000 login attempts associated with the campaign. These findings highlight the need for stronger identity protection, session monitoring, and rapid incident response.
1. How the Token-Replay Attack Worked
The campaign used a technique known as an adversary-in-the-middle (AitM) attack. Rather than relying exclusively on stolen passwords, attackers positioned fraudulent sign-in pages between victims and legitimate Microsoft authentication services.
The attack generally followed these stages:
Step 1: Capture the sign-in process
Victims were directed to fraudulent login pages that relayed authentication requests to legitimate Microsoft infrastructure. This allowed attackers to capture credentials and multi-factor authentication codes entered during the process.
Step 2: Steal the authenticated session token
After the victim successfully authenticated, the attacker obtained the resulting session token. This token could provide access to Microsoft 365 services without requiring the attacker to repeat the original authentication process.
Step 3: Replay the stolen token
Attackers reused the captured tokens from their own systems to attempt access to Microsoft 365 accounts. Researchers referred to this large-scale approach as token spraying, because it involved attempting access with multiple stolen tokens across different organizations.
Step 4: Establish persistent access
Once inside an account, attackers attempted to register their own authenticator methods and add unauthorized devices to Microsoft Entra ID. These changes could help them maintain access even if an original session expired or was revoked.
This attack demonstrates an important security distinction: MFA helps protect the authentication process, but a stolen authenticated sessio
n can still become an attack path.
2. What Happened After the Accounts Were Compromised?
The campaign involved more than unauthorized sign-ins. Researchers identified several activities designed to preserve access, conceal malicious behavior, and interfere with business communications.
Unauthorized changes to MFA methods
In at least 19 organizations, attackers removed existing authentication methods and registered new ones within three hours of the initial sign-in. In one observed case, a new authenticator application was registered less than 51 minutes after the session was hijacked.
Such changes can make account recovery more difficult and allow attackers to satisfy authentication challenges during subsequent access attempts.
Rogue devices in Microsoft Entra ID
Researchers identified at least 48 unauthorized device registrations across victim organizations. These devices could provide attackers with additional opportunities to obtain tokens and maintain access.
Unexpected device registrations should therefore be treated as potential security incidents, especially when they coincide with unusual sign-ins or changes to authentication settings.
Hidden email rules
Attackers also created inconspicuous inbox rules designed to delete or relocate messages containing terms related to payroll, deposits, and bonuses.
In one case, a compromised mailbox was configured to mark incoming messages as read and delete them. The account was subsequently used to send spam to hundreds of external recipients.
These tactics can conceal financial communications, interfere with business workflows, and delay the discovery of an account compromise.
The incident illustrates how identity compromise can quickly expand into email abuse, business email compromise, and potential financial fraud.
3. Why Traditional MFA Defenses May Not Be Enough
MFA remains an essential security control. However, organizations should understand the limitations of relying on it as their primary defense against identity-based attacks.
Session-token theft: An attacker who obtains a valid session token may be able to reuse the authenticated session without repeating the original MFA challenge.
Real-time phishing: AitM phishing pages can relay authentication activity to legitimate services while capturing information from the victim’s sign-in process.
Device registration abuse: Unauthorized device registrations can create additional persistence opportunities and complicate investigations.
Limited identity monitoring: If security teams monitor only failed logins or password changes, they may miss suspicious activity involving valid sessions, authentication methods, or inbox rules.
Delayed detection: Attackers may modify account settings and email behavior shortly after gaining access. Delayed investigation can give them more time to access sensitive communications and disrupt business operations.
Organizations should move beyond a login-only security model and continuously evaluate whether access sessions, devices, applications, and account behavior remain trustworthy.
4. What Organizations Should Do Immediately
Security teams using Microsoft 365 should review their identity security controls and investigate suspicious activity across Microsoft Entra ID and Exchange Online.
Recommended defensive actions
1. Revoke suspicious sessions
If an account is suspected of compromise, revoke its active sessions and refresh tokens using the appropriate Microsoft administrative controls. Reset credentials when warranted and investigate whether the attacker has retained other methods of access.
Session revocation may not instantly invalidate every access token in every scenario, so responders should verify containment and follow Microsoft’s current guidance.
2. Audit authentication methods
Review recent additions, removals, and modifications to MFA methods. Investigate unexpected authenticator registrations, especially those occurring shortly after unusual sign-ins.
3. Review registered devices
Audit Microsoft Entra ID for unfamiliar devices and suspicious device-registration activity. Validate ownership before removing entries, and investigate how unauthorized devices were added.
4. Inspect Exchange Online inbox rules
Look for recently created or modified rules that automatically delete, forward, mark as read, or relocate incoming messages. Pay particular attention to rules that target payroll, finance, executive, and authentication-related communications.
Also review mailbox forwarding settings and outbound email activity for evidence of abuse.
5. Investigate sign-in logs
Correlate sign-in events with IP addresses, locations, device details, authentication methods, session activity, and risk detections. Look for unusual access patterns and changes to security settings following a successful login.
6. Strengthen Conditional Access policies
Use Microsoft Entra Conditional Access to enforce appropriate authentication requirements across users, cloud applications, and client application types. Apply risk-based restrictions and device-compliance requirements where supported by the organization’s environment.
Evaluate whether device-code authentication is necessary for each user group and restrict or block the flow where it is not required. Avoid broad exclusions that weaken identity controls.
7. Protect privileged accounts
Apply least-privilege access, separate administrative accounts from everyday user accounts, and use phishing-resistant authentication methods where feasible. Closely monitor changes to privileged roles, authentication policies, and enterprise applications.
8. Establish an identity-focused incident response process
Define clear procedures for session revocation, credential recovery, device review, mailbox investigation, evidence preservation, and communication with affected users. After containment, determine whether sensitive information was accessed or whether financial transactions may have been manipulated.
5. Which Industries Face the Greatest Operational Concerns?
Identity-based attacks can affect any organization using Microsoft 365, but the consequences may be particularly significant in environments handling sensitive data or high-value business communications.
- Financial services: Unauthorized mailbox access can expose payment instructions, customer communications, and financial workflows. Hidden rules may help attackers conceal fraudulent requests.
- Healthcare: Compromised accounts may expose sensitive communications and disrupt administrative workflows involving patient services, billing, and third-party providers.
- Retail: Attackers may target finance, procurement, customer support, and supplier communications to facilitate fraud or access business information.
- Manufacturing: Compromised email accounts can expose supplier relationships, purchase orders, operational documents, and internal business communications.
- Government: Identity compromise can expose sensitive correspondence and undermine access controls across cloud-based collaboration environments.
- Technology and managed service providers: A compromised account with elevated permissions may create additional risks for connected applications, customer environments, and administrative workflows.
Organizations should prioritize controls based on account privileges, data sensitivity, business impact, and the extent of access available to each identity.
6. Building Stronger Defenses Against Token Theft
Responding to a single phishing campaign is not enough. Organizations need a layered identity security strategy that reduces the likelihood of token theft, limits unauthorized access, and improves detection.
Adopt phishing-resistant authentication. Where supported, use passkeys or hardware security keys based on FIDO2 standards. These help protect against credential phishing, although they should be combined with controls that address session theft and endpoint compromise.
Apply conditional access consistently. Evaluate user identity, device health, sign-in risk, application sensitivity, and other available signals before granting or maintaining access.
Monitor identity changes continuously. Alert on suspicious MFA modifications, unfamiliar device registrations, unusual mailbox rules, unexpected application consent, and abnormal sign-in behavior.
Reduce excessive privileges. Limit administrative access and regularly review permissions granted to users, service principals, and enterprise applications.
Train employees to recognize authentication threats. Explain how fraudulent sign-in pages and device-code phishing can compromise accounts, even when users believe they have completed a legitimate authentication process.
Test detection and response capabilities. Conduct identity-focused security assessments to validate whether monitoring systems can detect token misuse, unauthorized account changes, and suspicious email activity.
Conclusion: Secure the Session, Not Just the Login
The Microsoft 365 token-replay campaign demonstrates how attackers can move beyond password theft and exploit the trust established during authentication.
The reported compromise of 97 accounts across 79 organizations, alongside unauthorized device registrations and concealed email rules, reinforces the importance of continuous identity monitoring and effective incident response.
MFA remains vital, but organizations should combine it with phishing-resistant authentication, appropriately configured Conditional Access, session controls, device governance, mailbox monitoring, and rapid containment procedures.
The objective is not simply to verify who signs in. It is to continuously verify that access remains legitimate throughout the session.
How COE Security Can Help
COE Security supports organizations in strengthening identity security, evaluating access controls, identifying weaknesses in cloud environments, and improving their ability to detect and respond to cybersecurity incidents. Security assessments can help uncover gaps in authentication policies, privileged access, application permissions, and monitoring processes before attackers exploit them.
About COE Security
COE Security partners with organizations in financial services, healthcare, retail, manufacturing, and government to secure AI-powered systems and ensure compliance.
Our offerings include:
- AI-enhanced threat detection and real-time monitoring
- Data governance aligned with GDPR, HIPAA, and PCI DSS
- Secure model validation to guard against adversarial attacks
- Customized training to embed AI security best practices
- Penetration Testing (Mobile, Web, AI, Product, IoT, Network & Cloud)
- Secure Software Development Consulting (SSDLC)
- Customized CyberSecurity Services
Follow COE Security on LinkedIn for ongoing insights into safe, compliant AI adoption.
Follow COE Security on LinkedIn for practical cybersecurity insights, identity protection guidance, and updates to help your organization stay informed and cyber safe.
Click to read our LinkedIn feature article