Huntress: Microsoft 365 token replay hit 97 accounts at 79 organizations

Huntress says attackers replayed stolen Microsoft 365 sessions at 79 organizations, compromising 97 accounts between July 14 and September 22, 2026.

Huntress says attackers captured Microsoft 365 credentials, MFA codes, and access tokens through adversary-in-the-middle login pages, device-code phishing, and social engineering, then replayed the sessions. From more than 200,000 attempts, mainly from 193.26.115.0/24 and infrastructure tied to 1337 Services GmbH, they completed 497 sign-ins, compromised 97 accounts at 79 organizations, and registered at least 48 rogue Entra devices between July 14 and September 22, 2026. After access, they added authenticator apps, replaced MFA methods at 19 organizations, and created inbox rules that hid payroll and payment mail. Huntress did not name a malware family and did not attribute the campaign to GhostCode. It advises revoking sessions, resetting passwords, and tightening Conditional Access, noting that password resets do not remove attacker authenticators or rogue devices.