Huntress reported a campaign that compromised 97 Microsoft 365 accounts across 79 organisations between 14 July and 22 September 2026. The attackers stole post-MFA session tokens rather than passwords.
Security firm Huntress has documented a campaign that compromised 97 Microsoft 365 accounts across 79 organisations between 14 July and 22 September 2026. The attackers never cracked a password. They stole the session tokens Microsoft issues after multi-factor authentication (MFA) and replayed them from their own machines.
How the attack works
The technique is token replay. A user is steered to a fake sign-in page that forwards the password and the MFA code to the real Microsoft login, completing the sign-in for them. The session token Microsoft issues afterwards stays with the attacker. Because MFA has already been satisfied, whoever holds that token can open the mailbox without being challenged again.
Huntress recorded more than 200,000 login attempts in the campaign, of which 497 succeeded. Once inside, the attackers took additional steps to keep their access:
- 48 rogue device registrations: they enrolled their own machines into victims' Entra directories.
- MFA tampering: in 19 organisations, existing MFA methods were wiped and the attacker's own authenticator was registered instead. That registration survives a password reset.
- Hidden inbox rules: rules were created to hide or delete emails about payroll, payments and transfers.
Why it matters
The lesson here is not that MFA failed, but that MFA alone is not the finish line. In many organisations the security plan stops at "MFA is enabled, we're covered." Yet the token issued after a successful login is a stealable asset, and when it is stolen no second challenge is raised.
The second point worth noting is how deliberately the attackers positioned themselves to survive a password reset. An administrator who spots a compromise and only changes the password leaves the attacker's registered device and authenticator sitting in the directory.
What this means for small and mid-sized companies
Microsoft 365 is one of the most common business email platforms among small and mid-sized companies in Turkey. At that scale, there is rarely a team routinely reviewing Entra device registrations, MFA method history or inbox rules. The campaign was not aimed at technically complex environments so much as unmonitored ones.
Finance, purchasing and accounting mailboxes were prominent targets. Hiding payment correspondence with covert inbox rules is the groundwork for classic invoice fraud and bank-detail change scams. In sectors that run on heavy email traffic, such as logistics, shipping agencies and construction offices, that risk translates directly into financial loss.
What we recommend at Kamer Bilişim
- Build Conditional Access policies without exceptions. Require MFA for all users, all cloud apps and all client app types. Also restrict the device code sign-in flow through a Conditional Access authentication flow policy, since that flow was one of the routes used to obtain tokens in this campaign.
- Do not treat a password reset as incident response. Where compromise is suspected, revoke the sessions, reset the password, and then clear out unrecognised device registrations and MFA methods one by one. Skip that step and the access continues.
- Put a regular audit routine in place. Periodically review new Entra device registrations, MFA methods that were removed and re-added within minutes, and unnamed inbox rules that move mail into RSS or Conversation History folders. Turn off users' ability to consent to new applications on their own.
We can review your Microsoft 365 tenant's Conditional Access configuration, device and MFA registrations and inbox rules together. For on-site support across the Anatolian side of Istanbul or remote assistance, reach us through our contact page.
Source: Huntress, "M365 Token Spray and Replay Campaign" (22 October 2026); analysis by The Hacker News (26 October 2026).
Source: Huntress