Stolen login tokens used to hijack Microsoft 365 accounts at 79 organizations
Huntress counted 497 successful sign-ins and more than 200,000 failures from July 14 to September 22, 2026.
74
Product
Exchange Online
- Mentions · 7d2
- Mentions · 30d15
- All mentions20
- First seenSep 10, 2026
- Last mentioned3d ago
Timeline
20 articles · newest firstToken replay gave attackers Microsoft 365 access at 79 organizations
Huntress logged 497 successful sign-ins and over 200,000 failures from July 14 to September 22, 2026.
74
Microsoft explains how to restore blocked Exchange Online EWS
Admins can re-enable EWS until April 2027; Microsoft says apps should move to Microsoft Graph.
46
Storm-0940 used ARTEX in ConnectWise Cloud Backup supply-chain attack
Microsoft says the agents targeted more than 2,250 tenants at up to 2,900 sign-in attempts per minute.
84
Microsoft attributes ConnectWise supply-chain attack to Storm-0940
The group used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute; compromise counts are unstated.
82
ConnectWise Cloud Backup API secret used against Microsoft 365 tenants
Huntress saw malicious sign-ins across almost 1,000 Entra tenants, with more than 300 appearing to succeed.
78
ConnectWise suspends cloud services after M365 tenant access
Huntress says a Cloud Backup client assertion reached 162 Microsoft 365 tenants on October 15–16.
78
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Hackers abused ConnectWise Cloud Backup identities to access at least 162 Microsoft 365 tenants.
82
Microsoft Exchange Admin Center Issue Blocks Web Portal Access to Admins With “Internal Server Error”
Microsoft is investigating EX1500900, which blocks some admins from the Exchange admin center.
34
Microsoft Outlook to block MSIX attachments starting November
Microsoft will block .msix and .msixbundle attachments in Outlook on the web and new Outlook starting November.
42
Microsoft extends the Outlook naughty step with two more file types
Microsoft will block .msix and .msixbundle attachments in New Outlook for Windows and Outlook on the web.
34
CVE-2026-96940: Microsoft Fixes Exchange Server Flaw For Which Exploitation Is More Likely
Microsoft patched CVE-2026-96940, which lets authenticated attackers read other Exchange mailboxes in the same organization.
76
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
Microsoft patched CVE-2026-96940, an Exchange flaw that lets authenticated attackers read other users' mailboxes.
71
Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940)
Microsoft issued an out-of-band Exchange update for CVE-2026-96940, a same-organization mailbox read flaw.
66
Microsoft Pushes New Exchange V2 Update After Discovering New Security Flaw
Microsoft reissued September 2026 Exchange updates to fix CVE-2026-96940, an authenticated mailbox-access flaw scored 8.8.
67
Hackers Favor US Eastern Business Hours in M365 Phishing Campaign
KnowBe4 tracked 29,785 phishing emails abusing Microsoft 365 Direct Send to spoof internal senders while timing sends to US Eastern business hours.
58
Attackers use passkey-themed scams to hijack Microsoft 365 accounts
Microsoft tracks ongoing M365 cloud intrusions since May using passkey-themed helpdesk vishing, AiTM phishing, and device-code abuse.
78
Attackers call employees’ personal phones to break into Microsoft 365 accounts
Microsoft tracks vishing campaigns by Storm-3121 and Storm-3032 that impersonate IT staff, phish Microsoft 365 credentials, and steal cloud data.
74
Hackers Use Passkey-Themed Phishing to Hijack Microsoft 365 Accounts and Steal Cloud Data
Microsoft reports passkey-themed phishing campaigns hijacking Microsoft 365 accounts via AiTM and device-code flows, then exfiltrating cloud data.
66
Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts
Microsoft warns of vishing campaigns by Storm-3121 and Storm-3032 hijacking Microsoft 365 accounts via fake passkey alerts, adding attacker-controlled MFA and exfiltrating cloud data.
72
Related CVEs
by mentions- CVE-2026-969403%8.8Weak authorization privilege escalation in Microsoft Exchange Server
- CVE-2026-62911<1%8.0Capture-Replay Authentication Bypass in Microsoft Exchange Server
Appears with
- Microsoftvendor · 19
- Microsoft 365product · 13
- Microsoftorganization · 12
- Microsoft Graphproduct · 6
- SharePointproduct · 5
- ConnectWisevendor · 5
- Huntressorganization · 5
- ConnectWise Cloud Backupproduct · 4
- OneDriveproduct · 4
- Microsoft Teamsproduct · 4
- SharePoint Onlineproduct · 3
- Exchange Serverproduct · 3
- Storm-3032threat actor · 2
- BlackFilethreat actor · 2
- Storm-3121threat actor · 2
- Helixthreat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.