Microsoft 365 Accounts Compromised via Session Token Replay
Attackers are exploiting stolen Microsoft 365 session tokens to bypass multi-factor authentication and compromise accounts at numerous organizations.
An attacker successfully compromised Microsoft 365 accounts at 79 organizations over a ten-week period by replaying stolen sign-in session tokens, bypassing multi-factor authentication (MFA) entirely. The campaign, observed between July and September 2026, involved hundreds of thousands of failed login attempts and over 497 successful compromises, according to research from Huntress.
The sophisticated attack did not require the threat actor to obtain user passwords. Instead, victims were directed to fake sign-in pages that employed adversary-in-the-middle (AiTM) relays. These relays would pass the legitimate Microsoft login page and MFA prompt through to the user, but crucially, they captured the session token issued by Microsoft after successful authentication. Because this token is generated post-MFA, it grants the holder access without needing to re-authenticate.
In addition to AiTM relays, the attacker also obtained session tokens through device-code phishing, where users were tricked into entering a code on Microsoft's official sign-in page, and through social engineering tactics during standard login processes. Once acquired, these stolen tokens were then replayed in bulk, a technique Huntress dubbed "token spraying," drawing a parallel to password spraying but with session tokens instead of credentials.
The threat actor demonstrated a pattern of rapid exploitation, with hijacked sessions being used within minutes of their acquisition. The attacker utilized servers hosted by 1337 Services GmbH in Germany, and Microsoft Entra ID Protection independently flagged several of these malicious addresses. The campaign moved through different IP address blocks, suggesting an effort to evade detection and mitigation efforts.
Beyond initial access, the attacker implemented tactics to maintain persistence and conceal their activities. This included registering rogue computers in victims' Microsoft Entra directories, often named with a "DESKTOP-" prefix, and in some cases, altering existing MFA methods to ones controlled by the attacker. In at least 19 organizations, the victim's primary MFA method was replaced with a new one within three hours of the initial compromise.
Furthermore, the attacker created hidden inbox rules within compromised mailboxes to exfiltrate or conceal malicious activity. These rules, often named with single characters or seemingly innocuous strings, would delete incoming emails or move them to obscure folders like 'RSS Feeds' or 'Conversation History.' In one instance, the attacker used a compromised account to send a fraudulent payroll-related email to an external accountant, subsequently hiding all communications from that accountant.
Microsoft Entra ID Protection flagged many of the compromised accounts, and some organizations with robust Conditional Access policies were able to block the malicious sign-ins. However, the attacker's ability to replay tokens, bypass MFA, and establish persistence through rogue devices and modified MFA methods highlights significant security gaps. Huntress has provided mitigation guidance and indicators of compromise to help administrators detect and defend against similar attacks.