Stolen Microsoft 365 session tokens replayed into 79 organizations
Huntress reported on October 22, 2026 that one actor replayed Microsoft 365 tokens stolen through adversary-in-the-middle phishing and device-code phishing into 79 organizations between July 14 and September 22, 2026. The actor registered at least 48 rogue Entra devices and wiped and replaced victims' MFA methods, in 19 organizations within three hours of the first sign-in, so that access survived password resets.
- Victim
- Multiple: 79 organizations monitored by Huntress
- Industry
- Cross-industry
- Country
- Global
- Intrusion began
- Jul 14, 2026
- First disclosed
- Oct 22, 2026
- Actor
- Unattributed
- Initial access
- Phishing (adversary-in-the-middle)
- Identity control that failed
- Session and tokens
- MFA
- Present and bypassed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
The tokens worked from the attacker's infrastructure and the account let the attacker re-enrol MFA. Token protection and device binding, blocking device-code flow where unneeded, and requiring step-up to change MFA methods are the controls.
Go deeper on SWI
- Technique: Attacker-in-the-middle phishing proxy
- Technique: Device code phishing
- Technique: Token replay against an unbound endpoint
- Product involved: Microsoft Entra ID
- SWI coverage: huntress tracks stolen session replay into 79 microsoft 365 organizations
Sources
- M365 Token Spray and Replay Campaign Compromises Business Email Accounts, Huntress, Oct 22, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- AiTM phishing campaign against more than 10,000 Microsoft 365 organizations 2022 · Phishing (adversary-in-the-middle)
- Dropbox GitHub repositories stolen via CircleCI-themed phishing 2022 · Phishing (adversary-in-the-middle)
- Bybit cold-wallet theft via hijacked Safe{Wallet} developer AWS sessions 2025 · Session or token theft
- Comcast Xfinity customer data theft via Citrix Bleed 2023 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). Stolen Microsoft 365 session tokens replayed into 79 organizations. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-microsoft-365-token-replay-79-orgs/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.