Short answer
Huntress, a security firm, says attackers captured post-MFA session tokens through phishing relays and replayed them at scale between 14 July and 22 September 2026. It reports 97 compromised accounts at 79 organizations, with rogue devices registered and inbox rules created to hide payroll mail. The victim organizations are not named.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | 79 unnamed Microsoft 365 organizations (reported by Huntress) |
|---|---|
| Incident type | Account takeover |
| Status | Confirmed by the organization |
| Sector | Cross-sector business email |
| Country | Global |
| Detected | 2026-07-14 |
| Disclosed | 2026-10-26 |
| People or records affected | 97 accounts at 79 organizations, per The Hacker News; Huntress reports 497 successful sign-ins from more than 200,000 attempts |
What data was exposed
- Email inboxes of compromised Microsoft 365 accounts
- Multi-factor authentication settings, which attackers removed and re-registered in at least 19 organizations
- Payroll, direct deposit and bonus emails, which hidden inbox rules targeted
What happened
Huntress, a managed security provider, published research on a campaign it calls token spraying against Microsoft 365. It says the activity ran from 14 July to 22 September 2026. The Hacker News summarized it on 26 October.
Instead of guessing passwords, the attackers captured session tokens after a victim had already passed multi-factor authentication. Huntress says they got those tokens through adversary-in-the-middle relays, device-code phishing and social engineering, then replayed them against Microsoft 365. The gap between capture and replay was as short as 4 minutes on one occasion.
Scale
Huntress reports 497 successful sign-ins out of more than 200,000 attempts, across 79 victim organizations. The Hacker News puts compromised accounts at 97, with 48 rogue devices registered in Microsoft Entra. Replay traffic came from one hosting range, 193.26.115.0/24, operated by 1337 Services GmbH. Huntress says the provider’s addresses are used by attackers who bring their own IPs. The Hacker News notes that StarkRDP, linked to the provider, said it operates lawfully and is not involved.
What the attackers did next
In at least 19 organizations the attackers removed existing MFA methods and added their own within three hours of first sign-in. Some set up hidden inbox rules, with names like “.” or “sss”, that moved or deleted mail about payroll, deposits and bonuses. In one case, Huntress says, an attacker emailed an outside accountant about payroll and hid the replies from the victim. One compromised mailbox sent spam to hundreds of recipients.
What to do
Huntress advises revoking sessions and resetting the password together, because a reset alone leaves attacker devices and MFA methods behind. It also advises auditing devices and authenticators, checking inbox rules, restricting device-code sign-in, and requiring MFA or blocking access across all users, cloud apps and client app types.
For individuals, the danger is a legitimate colleague’s mailbox asking you to change bank details. Verify any payment or payroll change by phone. See our guide to fake invoice and business email scams, our phishing messages guide and the data breach checklist.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Business email compromise: fake payroll, direct deposit or invoice change requests sent from a real, hijacked mailbox.
- Spam and phishing sent from compromised accounts to your contacts.
- Fake Microsoft sign-in pages and device-code prompts used to capture tokens.
What to do if you are affected
- 01If you suspect token replay, revoke sessions and reset the password. A password reset alone leaves attacker devices and MFA methods in place.
- 02Audit Entra devices, especially unfamiliar ones named DESKTOP- followed by random characters, and remove unrecognized authenticators.
- 03Review inbox rules for very short or punctuation-only names and for rules that hide mail about payroll or banking.
- 04Restrict the device-code sign-in flow using Conditional Access.
- 05Require MFA or block access for all users, all cloud apps and all client app types, as Huntress recommends.
Frequently asked questions
Does MFA stop this attack?
Not by itself. Huntress says the attackers captured session tokens issued after a successful MFA step, so replaying them did not trigger MFA again. Conditional Access policies that block unusual sources helped, according to Huntress.
What is token spraying?
Huntress uses the term for replaying many stolen session tokens against many accounts, like password spraying but with tokens captured through adversary-in-the-middle relays, device-code phishing and social engineering.
Which organizations were hit?
Neither Huntress nor The Hacker News names the victims. Both report 79 organizations.
Is this a Microsoft vulnerability?
The sources we reviewed describe phishing and token theft against sign-in flows, not a flaw in Microsoft 365 itself.
Sources
- Token spraying: replaying stolen Microsoft 365 sessions at scale, Huntress, 2026-10-26
- Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations, The Hacker News, 2026-10-26
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.