Microsoft 365 Token Replay Campaign Hits 79 Organizations: What IT Teams Should Do Now

Session token theft is now a mainstream route into business email. This campaign did not guess passwords; it captured sign-in sessions after victims completed MFA and replayed them from attacker infrastructure.

The numbers below come from Huntress and were reported by Help Net Security and The Hacker News. Coverage differs slightly in how it summarizes totals, so this article uses the figures stated in the Huntress report itself.

What happened and when

Huntress published research on October 22, 2026 describing a campaign it observed between July 14 and September 22, 2026. The company tied related incidents to 79 organizations and recorded at least 497 successful Microsoft 365 sign-ins out of more than 200,000 attempts.

Attackers captured sessions through adversary-in-the-middle relays, fake sign-in pages, device-code phishing and social engineering during legitimate logins, according to the Huntress report. Because a session token is issued after multifactor authentication succeeds, replaying it does not trigger another MFA prompt. Help Net Security covered the findings on October 23, and The Hacker News followed on October 26.

What the attackers did after getting in

After taking over sessions, the attackers worked to keep access and hide mail. Reporting from Huntress and the press coverage describes changes to authentication methods, rogue devices and inbox rules that suppressed messages about money.

• In 19 organizations, existing MFA methods were removed and a new authenticator was registered within three hours of the first campaign sign-in.
• At least 48 fake computers were registered in victim Microsoft Entra directories, with names such as DESKTOP- followed by eight hexadecimal characters.
• Hidden inbox rules moved or hid messages mentioning payroll, deposits and similar terms.
• Replay traffic came mainly from the 193.26.115.0/24 address range, which Huntress linked to a hosting provider; the report notes this identifies servers used in the attacks, not provider involvement.

Why this matters for B2B software buyers

This campaign shows that MFA alone does not stop attacks that steal an already authenticated session. Any company that depends on Microsoft 365 for email, files and identity should treat session and device controls as part of its core security stack.

It also affects vendor selection. Buyers of identity, email security and monitoring tools should ask how a product detects token replay, rogue device registration and suspicious inbox rules, not only whether it supports MFA.

What to do now: checklist

Start with containment and detection, then harden policy. The steps below follow the mitigation guidance Huntress published, and each can be done by a Microsoft 365 administrator with Conditional Access and Entra access.

• Revoke sessions and reset passwords for any account you suspect; a password reset alone leaves attacker-registered devices and MFA methods in place.
• Audit Entra devices and remove unrecognized ones after confirming with owners.
• Review registered MFA methods for entries cleared and re-registered within minutes.
• Search mailboxes for short or punctuation-only inbox rule names and rules that move mail to unusual folders.
• Restrict the device-code sign-in flow with Conditional Access; see the Microsoft Learn guidance on blocking authentication flows.
• Review new enterprise applications and limit user consent to new apps.

Related SaaSPodium categories

Teams reviewing their controls can compare tools in these SaaSPodium categories:

• Multi-factor authentication software for stronger sign-in methods.
• Identity and access management software for policy, lifecycle and device control.
• SIEM software for sign-in and mailbox log monitoring.

Frequently Asked Questions

Does MFA protect against token replay?
Not on its own. If an attacker steals a session token issued after MFA, replaying it does not require a new MFA prompt. Combine MFA with Conditional Access, device compliance requirements, short session lifetimes and monitoring for unusual sign-in sources.

What is the first step if I suspect a Microsoft 365 account was taken over?
Revoke the user sessions and reset the password, then remove any attacker-registered devices and MFA methods and check for hidden inbox rules. A password reset by itself does not remove devices or authenticators the attacker added.

Which tools help detect this kind of attack?
Identity protection, SIEM and email security tools can flag risky sign-ins, new device registrations and unusual mailbox rules. Evaluate them on whether they alert on token replay patterns, not just failed logins, and test the alerts with a simulated session.