Hackers Use Stolen Login Tokens to Hijack Microsoft 365 Accounts at 79 Organizations

Between July 14 and September 22, 2026, attackers reused stolen Microsoft 365 session tokens to compromise accounts at 79 organizations, achieving at least 497 successful sign-ins, a Huntress investigation found.

Over the ten-week campaign the adversaries also generated more than 200,000 failed login attempts across monitored environments. Rather than brute-forcing passwords, the attackers focused on hijacking already-authenticated sessions so they could bypass multi-factor authentication prompts.

Huntress published the findings in a report dated October 22. The report describes token theft and account abuse; it does not attribute the activity to a specific named malware family. As part of the operation the threat actors registered at least 48 unauthorized Microsoft Entra devices and altered victims’ authentication methods to preserve access.

How the campaign worked

The attackers combined adversary-in-the-middle (AitM) phishing relays, device-code phishing, and social engineering. In relay-style AitM attacks a counterfeit sign-in page forwarded the victim’s credentials and MFA challenge to Microsoft, captured the resulting authenticated session, and then replayed it from attacker infrastructure.

Replay activity was conducted from rented infrastructure hosted via German provider 1337 Services GmbH. Device-code phishing provided an alternative route: as with other OAuth device-authorization abuses, victims can approve a malicious session while signing into Microsoft’s legitimate pages. Huntress observed this device-code approval technique during the campaign’s August wave.

Huntress grouped the replay techniques into two toolsets. “Build A” performed scripted token exchanges using Microsoft Office and Authentication Broker clients, targeting APIs and services such as Microsoft Graph, Exchange Online, and SharePoint. “Build B” replayed browser sessions through OfficeHome.

The interval between capture and misuse could be very short—Huntress documented a 12-minute gap in a July event and a four-minute gap in a September takeover. The infrastructure that captured sessions and the hosts that replayed them were separate, so blocking one component did not automatically stop the other.

Persistence and mailbox concealment

In 19 of the affected organizations the attackers removed existing MFA methods and registered replacements within three hours of their first campaign-linked sign-in. The registered rogue devices also gave attackers an additional means to persist in victims’ environments.

Although Huntress did not attribute this campaign to the GhostCode phishing kit, prior GhostCode activity has shown how device enrollment can be abused, underscoring the importance of checking device registration during token-theft investigations.

Attackers also created inbox rules to hide incoming messages. In one case a compromised account forwarded a payroll email to an external accountant while rules concealed banking-related messages and replies. The threat actors additionally used accounts to send spam to hundreds of recipients.

Huntress recommends revoking active sessions, resetting compromised passwords, removing unauthorized devices and MFA methods, and auditing mailbox rules. Organizations should limit unneeded device-code authentication and review newly granted application permissions. During one wave of the campaign Conditional Access policies blocked 1,052 attempts at four organizations, demonstrating the value of access controls beyond MFA alone.

Indicators of compromise (IoCs)

Note: IP addresses and domains above are intentionally defanged (for example, using [.] ) to prevent accidental resolution or linking. Re-fang only inside controlled threat-intelligence systems such as MISP, VirusTotal, or your SIEM.

Provide your SOC the alert context to stop incidents quickly. Integrate threat intelligence from thousands of SOCs.