Stolen Sign-In Tokens Let Attackers Slip Past MFA and Hijack 97 Microsoft 365 Accounts

Researchers at Huntress have disclosed a Microsoft 365 campaign that used an adversary-in-the-middle (AitM) relay to capture sign-in sessions and then replay the stolen tokens to break into email accounts. Between July 14 and September 22, 2026, the activity reached 79 organisations. Huntress detected 497 successful sign-ins out of more than 200,000 login attempts, and the attackers ultimately compromised 97 accounts and registered 48 rogue Entra devices.

The attack relies on a fake login page that sits between the victim and the real Microsoft sign-in. It captures the password and the multi-factor authentication (MFA) code, and passes them on to the genuine page. The attacker then collects the access token Microsoft issues after sign-in, so they do not need to defeat MFA a second time. Within minutes, the token is replayed from the attacker's own devices in automated attempts against Microsoft 365 services. Huntress calls this approach token spraying, because many stolen tokens are replayed at scale across several organisations, much like password spraying.

Once inside, the attackers added their own authenticator app so they could keep passing MFA challenges even if the stolen session expired or was revoked. In at least 19 organisations, the victim's existing MFA methods were removed and a new one registered within three hours of the first sign-in. In one case on July 21, 2026, a new authenticator app named "iPhone 13" was activated less than 51 minutes after the session was hijacked.