Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens

Hackers compromised Microsoft 365 accounts at 79 organizations by reusing stolen login tokens, recording at least 497 successful sign-ins between July 14 and September 22, 2026.

The ten-week campaign also generated more than 200,000 failed login attempts across monitored customer environments. The attackers targeted authenticated sessions rather than relying on password guessing.

Similar to previously reported Microsoft 365 session theft attacks, this approach lets criminals reuse proof that a user has already completed multi-factor authentication, giving them access without repeating that challenge.

Researchers from Huntress identified the campaign and detailed their findings in an October 22 report. Their investigation describes token theft and account abuse, not a named malware family. The attackers registered at least 48 rogue Microsoft Entra devices and replaced victims’ authentication methods to maintain access.

Hackers Hijack Microsoft 365 Accounts at 79 Organizations

The operation combined adversary-in-the-middle phishing, device-code phishing, and social engineering. In the relay-based attacks, a fake sign-in page forwarded the victim’s login and MFA challenge to Microsoft, then captured the resulting authenticated session.

Attackers replayed that session from rented infrastructure operated through German hosting provider 1337 Services GmbH. Device-code phishing offered another route.

As earlier coverage of OAuth device authorization abuse explains, victims can approve an attacker-controlled session while signing in on Microsoft’s legitimate website. Huntress observed this technique during the campaign’s August wave.

Researchers separated the replay activity into two toolsets. Build A used scripted token exchanges through Microsoft Office and Authentication Broker clients, targeting services including Microsoft Graph, Exchange Online, and SharePoint. Build B replayed browser sessions through OfficeHome.

The gap between authentication and account takeover was sometimes minutes: 12 minutes in one July incident and four minutes during the final September takeover. Capture relays and replay hosts used separate infrastructure, meaning blocking one side would not automatically stop the other.

Persistent Access and Hidden Mailbox Activity

In 19 organizations, attackers wiped existing MFA methods and registered replacements within three hours of their first campaign-linked sign-in. Rogue devices provided another foothold.

Separately documented GhostCode phishing kit activity illustrates why device enrollment deserves attention during token-theft investigations, although Huntress did not attribute this campaign to GhostCode.

Attackers also created inbox rules that concealed incoming messages. One compromised account sent a payroll-related email to an external accountant, while rules hid banking-related messages and replies. Other activity included sending spam to hundreds of recipients.

Huntress recommends revoking sessions, resetting passwords, removing unauthorized devices and MFA methods, and reviewing inbox rules.

Organizations should restrict unnecessary device-code authentication and examine new application permissions. Conditional Access blocked 1,052 attempts at four organizations during one campaign wave, demonstrating the value of policy enforcement beyond MFA alone.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens appeared first on Cyber Security News.