Microsoft 365 token replay campaign hit 79 organisations
Oct 26, 2026 · Summarized by Fundy Tech from The Hacker News
Attackers used fake login pages to steal Microsoft 365 session tokens and break into 97 accounts at 79 organisations. Huntress says the campaign ran from July 14 to September 22, 2026.
Key points
- Huntress saw 497 successful sign-ins from more than 200,000 login attempts.
- Attackers compromised 97 accounts and registered 48 rogue Entra devices.
- Some inboxes got hidden mail rules that deleted payroll and bonus emails.
Why it matters
This shows that MFA alone is not enough if attackers steal and replay session tokens. Any business using Microsoft 365 should watch for strange sign-ins, new devices, and inbox rules. Households with work or school accounts should be careful with fake login pages and unsolicited sign-in prompts. Review account activity and remove unknown devices or authenticator methods quickly.
Who’s affected: Microsoft 365 accounts at 79 organisations
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.