Stolen Microsoft 365 sessions replayed at 79 organizations
Original title: Microsoft 365 accounts compromised at 79 organizations, no passwords needed
Huntress counted 497 successful sign-ins and over 200,000 failures from July 14 to September 22, with inbox rules hiding mail.
Huntress says an attacker replayed stolen Microsoft 365 sign-in sessions for ten weeks and entered email accounts at 79 organizations without needing passwords. Victims were sent through adversary-in-the-middle relays and device-code or social-engineering lures that captured tokens issued after MFA. The attacker registered rogue Entra devices, replaced MFA methods at 19 organizations, and created inbox rules that deleted or hid mail, including a payroll lure to an external accountant. Replay came from 1337 Services GmbH addresses that Entra ID Protection flagged; four organizations' Conditional Access policies blocked one later address 1,052 times.
Unconfirmed: Huntress attributes the activity to one attacker; the report does not name the operator.
- Sessions were replayed from six addresses in 193.26.115.0/24 across four phases.
- Huntress found at least 48 rogue devices named DESKTOP- plus eight hex characters.
- In a July 21 case, an iPhone 13 authenticator was added less than an hour after hijack.
- From September 11, one address completed hundreds of sign-ins at nearly 30 organizations over four days.
- A password reset does not remove an attacker-registered authenticator unless the account is audited.
Impact: Mailbox access and persistent sign-in after MFA via stolen tokens
| Product | Affected |
|---|---|
| Microsoft 365 | — |
- 1.Audit Entra for DESKTOP- devices with eight hex characters and remove rogue registrations.
- 2.Check MFA methods added after suspicious sign-ins; a password reset alone does not remove them.
- 3.Review inbox rules named ".", "sss" or "iT" and Conditional Access blocks on campaign addresses.
- ATT&CK
- T1557 Adversary-in-the-MiddleT1528 Steal Application Access TokenT1566 PhishingT1098 Account ManipulationT1564.008 Email Hiding Rules
- Vendors
- Microsoft
- Products
- Microsoft 365Microsoft Entra ID
- Organizations
- Huntress1337 Services GmbH
- Countries
- Germany
From the original article
3 min read at helpnetsecurity.com
An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress. The researchers tracked the campaign between July 14 and September 22, 2026, counting 497 successful sign-ins and more than 200,000 failed login attempts.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.