Stolen Microsoft 365 Sessions Opened Mailboxes at 79 Organizations Without a Single Password. The Campaign by the Numbers
Huntress tracked a ten-week campaign that replayed stolen Microsoft 365 sign-in tokens to break into email accounts at 79 organizations, then registered fake devices, swapped MFA methods and hid mail with inbox rules. Here are the numbers and the layered defenses that blunt this kind of attack.
Here Is How Layered Defenses Help When Attackers Skip the Password and Steal the Session
Multifactor authentication stops most password attacks. It does not stop someone who steals the session token Microsoft issues after you have already passed MFA. Researchers at Huntress have documented a campaign that did exactly that, at scale, and then worked to stay hidden inside the mailboxes it reached.
This Pick is based on Help Net Security’s report on Huntress’s research, which includes indicators of compromise and mitigation guidance.
The campaign by the numbers
- 10 weeks: July 14 to September 22, 2026.
- 79 organizations with compromised email accounts.
- 497 successful sign-ins and more than 200,000 failed attempts.
- 6 IP addresses, all in one block at hosting provider 1337 Services GmbH in Hamburg, used across four phases. Blocking any single address would have stopped one phase at most.
- 12 minutes, then 4: how quickly stolen sessions were replayed after victims reached the MFA prompt, in incidents on July 21 and September 22.
- 48+ rogue computers registered in victims’ Microsoft Entra directories, each named “DESKTOP-” plus eight hexadecimal characters.
- 19 organizations where existing MFA methods were wiped and a new one registered within three hours.
- About 30 organizations hit over four days after September 11, when the attacker switched to an automated tool.
- 1,052 sign-ins blocked, all at four organizations whose Conditional Access policies refused them.
How the tokens were stolen
Most victims landed on fake sign-in pages that relayed the real Microsoft login and MFA prompt, an adversary-in-the-middle setup that captures the session token once sign-in completes. Others were tricked through device-code phishing, entering a code on Microsoft’s legitimate page, or through social engineering. Huntress calls the bulk replay “token spraying,” the same pattern as password spraying but with stolen sessions.
What the attacker did inside
To keep access after a session expired, the attacker registered fake devices and replaced victims’ MFA methods, in one case adding an authenticator labeled “iPhone 13” within an hour. Inbox rules with names like “.”, “sss” and “iT” deleted mail or moved it to folders such as RSS Feeds and Conversation History. In one mailbox, rules caught anything mentioning payroll, direct deposit, bank or bonus, and hid all mail from an outside accountant who had just been sent a payroll-related email from the compromised account.
Layer by layer
Layer 1: Phishing-resistant sign-in
Passkeys and security keys are tied to the real site, which makes relay pages far less effective. Start with finance, payroll and executives.
Layer 2: Conditional Access that checks more than the password
Policies that require compliant or managed devices, block unexpected locations, or restrict the device-code sign-in flow are what stopped 1,052 attempts in this campaign. In Microsoft 365 that is Entra Conditional Access; other identity platforms offer similar controls.
Layer 3: Alert on persistence moves
New device registrations, new MFA methods and new inbox rules are all quiet signals. Alert on them, and review device lists for generic “DESKTOP-” names nobody recognizes.
Layer 4: Contain fully when something trips
A password reset alone does not remove an attacker’s registered authenticator or device. Revoke sessions, reset the password, and remove unknown devices, MFA methods and inbox rules together.
Layer 5: Verify money requests out of band
Payroll and banking changes should be confirmed by phone using a number you already have, never by replying to the email that asked.
What this means for your company
If your team uses Microsoft 365, MFA is necessary but no longer enough on its own. This week, review registered devices and MFA methods for your finance and leadership accounts, search for inbox rules that move mail to rarely used folders, and confirm you can revoke sessions quickly. Then work toward phishing-resistant sign-in and device-based Conditional Access. Product names here are examples only. The protection comes from stacking the layers, so a stolen token runs into another barrier instead of an open mailbox.
Need help locking down Microsoft 365 sign-ins and spotting hidden inbox rules before they cost you a payroll run? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
