Stolen login tokens used to hijack Microsoft 365 accounts at 79 organizations
Huntress counted 497 successful sign-ins and more than 200,000 failures from July 14 to September 22, 2026.
74
Product
Microsoft Graph
- Mentions · 7d3
- Mentions · 30d16
- All mentions26
- First seenAug 26, 2026
- Last mentioned4d ago
Timeline
26 articles · newest firstToken replay gave attackers Microsoft 365 access at 79 organizations
Huntress logged 497 successful sign-ins and over 200,000 failures from July 14 to September 22, 2026.
74
Android Authenticator flaw let apps steal work tokens
An installed app with no permissions could impersonate Teams and obtain Graph tokens; fixed in 6.2606.4246.
66
Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.
80
Many minimal agent tool grants cannot be ranked
For 29.8–33.3% of Microsoft Graph tasks, minimal sufficient grants form an antichain with no smaller choice.
50
Microsoft explains how to restore blocked Exchange Online EWS
Admins can re-enable EWS until April 2027; Microsoft says apps should move to Microsoft Graph.
46
Storm-0940 used ARTEX AI in ConnectWise supply-chain attacks
Microsoft says privileged cloud access sometimes took under three hours, with more than 2,250 tenants targeted.
84
Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups
Stolen ConnectWise Cloud Backup credentials accessed 162 Microsoft 365 tenants, forcing ConnectWise to halt backups.
78
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts
Attackers used a stolen ConnectWise Cloud Backup secret to access 173 Microsoft 365 tenants.
85
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Attackers used a compromised ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 tenants.
80
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
Huntress says abused ConnectWise Cloud Backup credentials accessed at least 162 Microsoft 365 tenants.
84
AI Agent Workflows Could Expose Credentials Through Trusted Developer Tools
Trellix warns AI agent workflows can leak credentials from vaults into commands, logs, and model context.
52
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft and partners disrupted three phishing kits linked to over one billion scam messages worldwide.
82
Midnight Blizzard Uses Captive Portals to Deliver CornFlake RAT and Steal Traveler Credentials
Midnight Blizzard's Storm-2945 resumed hotel captive-portal attacks that deliver CornFlake and steal traveler credentials.
78
Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel
China-linked UAT-11587 used the Antino backdoor and Microsoft 365 to spy on Asian governments.
78
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
Cisco Talos says China-nexus UAT-11587 deployed the Antino backdoor against Asian government and policy organizations.
78
Microsoft Warns of EvilTokens AI Phishing Service Hijacking Thousands of Accounts
EvilTokens PaaS hijacks device-code auth to steal tokens and enable BEC at scale, compromising 12,000+ inboxes across 10,000+ organizations.
85
DavMail 7.0.0 puts most of its work into Microsoft Graph
DavMail 7.0.0 shifts its Exchange gateway work to Microsoft Graph and enables folder delta sync by default.
8
Revoking the token didn’t kill the backdoor
Analysis of the GraphWorm implant shows Webworm operators rotate OAuth credentials to survive token revocation, using OneDrive dead-drop C2 invisible to network defenses.
48
Passkey-themed phishing attacks lead to Microsoft 365 data theft
Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.
78
Attackers use passkey-themed scams to hijack Microsoft 365 accounts
Microsoft tracks ongoing M365 cloud intrusions since May using passkey-themed helpdesk vishing, AiTM phishing, and device-code abuse.
78
Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data
Threat actors use voice calls and Microsoft Graph API via BYOD devices to access Microsoft 365, then sell access to extortion groups like ShinyHunters.
70
Attackers call employees’ personal phones to break into Microsoft 365 accounts
Microsoft tracks vishing campaigns by Storm-3121 and Storm-3032 that impersonate IT staff, phish Microsoft 365 credentials, and steal cloud data.
74
Hackers Use Passkey-Themed Phishing to Hijack Microsoft 365 Accounts and Steal Cloud Data
Microsoft reports passkey-themed phishing campaigns hijacking Microsoft 365 accounts via AiTM and device-code flows, then exfiltrating cloud data.
66
Passkey-themed social engineering leads to identity and cloud compromise
Microsoft tracks ongoing cloud intrusions where passkey-themed helpdesk lures enable AiTM credential theft, MFA persistence, and SharePoint data theft.
76
CISA Red Team Fully Compromised Two Critical Infrastructure Orgs
CISA red teams achieved full domain and cloud compromise at two critical infrastructure orgs; one SOC never detected the intrusion.
72
Related CVEs
by mentions- CVE-2026-80097<1%8.6Improper Authentication in Microsoft Authenticator Enables Local Privilege Escalation
Appears with
- Microsoftvendor · 26
- Microsoft 365product · 17
- Microsoftorganization · 8
- OneDriveproduct · 8
- Huntressorganization · 7
- ConnectWisevendor · 6
- SharePointproduct · 6
- Exchange Onlineproduct · 6
- Microsoft Entraproduct · 5
- ConnectWise Cloud Backupproduct · 4
- ShinyHuntersthreat actor · 3
- ConnectWiseorganization · 3
- Googlevendor · 3
- Helixthreat actor · 2
- Falconthreat actor · 2
- 1337 Services GmbHorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.