Stolen login tokens used to hijack Microsoft 365 accounts at 79 organizations
Original title: Hackers Hijack Microsoft 365 Accounts at 79 Organizations Using Stolen Login Tokens
Huntress counted 497 successful sign-ins and more than 200,000 failures from July 14 to September 22, 2026.
Huntress says attackers reused stolen Microsoft 365 login tokens at 79 organizations, recording at least 497 successful sign-ins between July 14 and September 22, 2026, plus more than 200,000 failed attempts. The ten-week operation used adversary-in-the-middle and device-code phishing, then replayed authenticated sessions from rented infrastructure at 1337 Services GmbH. Attackers registered at least 48 rogue Entra devices, replaced MFA methods at 19 organizations, and created inbox rules that hid messages. Huntress did not name a malware family and did not attribute the campaign to GhostCode.
Unconfirmed: Huntress did not attribute the campaign to the GhostCode phishing kit.
- Takeover followed authentication by 12 minutes in one July case and four minutes in September.
- Build A used Office and Authentication Broker clients; Build B replayed browser sessions through OfficeHome.
- In 19 organizations, MFA methods were wiped and replaced within three hours.
- Conditional Access blocked 1,052 attempts at four organizations during one wave.
- Main replay range cited is 193.26.115.0/24, with separate capture and replay hosts.
Impact: Access to Microsoft 365 sessions without repeating MFA
| Product | Affected |
|---|---|
| Microsoft 365 | — |
- 1.Revoke sessions, reset passwords, and remove unauthorized devices and MFA methods.
- 2.Review inbox rules and new application permissions.
- 3.Restrict unnecessary device-code authentication and enforce Conditional Access.
- ATT&CK
- T1557 Adversary-in-the-MiddleT1566 PhishingT1550.001 Application Access TokenT1098 Account ManipulationT1564.008 Email Hiding Rules
- Vendors
- Microsoft
- Organizations
- Huntress1337 Services GmbH
- Countries
- Germany
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 124.198.132.33 | mber replay burst IPv4 193.26.115[.]210 Build B replay IPv4 124.198.132[.]33 Hijacked session continuation IPv4 45.83.31[.]44 , 192.15 |
| ipv4 | 167.148.41.96 | elay IPv6 2400:8d60:2::1:841d:5dd Evoxt phishing relay IPv4 167.148.41[.]96 Payroll-hiding rules Client ID d3590ed6-52b3-4102-aeff-aa |
| ipv4 | 185.238.2.195 | 5.83.31[.]44 , 192.159.99[.]172 Failed replay attempts IPv4 185.238.2[.]195 July phishing relay IPv6 2400:8d60:2::1:841d:5dd Evoxt ph |
| ipv4 | 192.159.99.172 | 132[.]33 Hijacked session continuation IPv4 45.83.31[.]44 , 192.159.99[.]172 Failed replay attempts IPv4 185.238.2[.]195 July phishing |
| ipv4 | 193.26.115.16 | vice registration IPv4 193.26.115[.]199 Build B replay IPv4 193.26.115[.]16 Build A; device-code phishing IPv4 193.26.115[.]21 Build |
| ipv4 | 193.26.115.199 | nge IPv4 193.26.115[.]221 Build A; device registration IPv4 193.26.115[.]199 Build B replay IPv4 193.26.115[.]16 Build A; device-code |
| ipv4 | 193.26.115.21 | lay IPv4 193.26.115[.]16 Build A; device-code phishing IPv4 193.26.115[.]21 Build A; SharePoint IPv4 193.26.115[.]72 September replay |
| ipv4 | 193.26.115.210 | SharePoint IPv4 193.26.115[.]72 September replay burst IPv4 193.26.115[.]210 Build B replay IPv4 124.198.132[.]33 Hijacked session con |
| ipv4 | 193.26.115.221 | ifact Role Network 193.26.115[.]0/24 Main replay range IPv4 193.26.115[.]221 Build A; device registration IPv4 193.26.115[.]199 Build |
| ipv4 | 193.26.115.72 | code phishing IPv4 193.26.115[.]21 Build A; SharePoint IPv4 193.26.115[.]72 September replay burst IPv4 193.26.115[.]210 Build B repl |
| ipv4 | 45.83.31.44 | ay IPv4 124.198.132[.]33 Hijacked session continuation IPv4 45.83.31[.]44 , 192.159.99[.]172 Failed replay attempts IPv4 185.238.2[ |
| sha256 | d8a3fedb1a3cd1287ca47c6851a49e6052ab6116b43666e674765ca892d798ce | or iPhone 13 Attacker-added label Authenticator token apns2-d8a3fedb1a3cd1287ca47c6851a49e6052ab6116b43666e674765ca892d798ce Published device token Inbox rules . , sss , ss , iT , ,. , |
From the original article
3 min read at cybersecuritynews.com
Hackers compromised Microsoft 365 accounts at 79 organizations by reusing stolen login tokens, recording at least 497 successful sign-ins between July 14 and September 22, 2026. The ten-week campaign also generated more than 200,000 failed login attempts across monitored customer environments. The attackers targeted authenticated sessions rather than relying on password guessing.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.