Microsoft 365 Token Replay Attacks: 97 Accounts Hacked Despite MFA

What if an attacker could get into your Microsoft 365 email without knowing your password or passing multifactor authentication again? That is exactly the threat highlighted by a newly reported Microsoft 365 attack campaign.

According to cybersecurity researchers at Huntress, attackers compromised 97 Microsoft 365 accounts across 79 organizations by stealing and reusing authentication tokens. The campaign shows an uncomfortable reality: even businesses using multifactor authentication (MFA) can suffer account takeovers when attackers get hold of a valid sign-in session. For any small business that runs on Microsoft 365 for email, documents, and daily operations, this one is worth understanding.

What happened in the Microsoft 365 token replay attacks?

Huntress investigated a campaign running between July 14 and September 22, 2026, and reported:

• 79 organizations with compromised Microsoft 365 accounts.
• 97 user accounts compromised.
• More than 200,000 failed sign-in attempts tied to the campaign.
• 497 successful sign-in events observed.
• At least 48 unauthorized devices registered in affected Microsoft Entra environments.
• Attackers modified MFA methods and created hidden email rules to keep access and hide their activity.

Rather than relying on stolen passwords alone, the attackers used a technique called token replay: reusing authentication sessions obtained through phishing. That let them reach Microsoft 365 services without making the victim complete another normal sign-in.

What is a Microsoft 365 token replay attack?

When you sign in to Microsoft 365, Microsoft checks your identity using your credentials and any required factors. After you authenticate, the service issues tokens that let your apps reach authorized resources without asking you to sign in over and over. These tokens are a normal, important part of modern authentication. They become dangerous only when an attacker gets one.

A token replay attack is when an attacker steals a valid authentication token and reuses it to access the victim's account or services. Think of it this way: your password and MFA prove who you are at the entrance; once you are in, your session token works like a temporary access pass. If an attacker steals a usable pass and the service accepts it, they can get in without repeating the original sign-in. This is closely related to session cookie theft, and it is why token theft is dangerous even when MFA is switched on.

How did attackers steal Microsoft 365 sessions?

The reported campaign used a technique called Adversary-in-the-Middle (AitM) phishing. (A related but distinct Microsoft 365 threat, the SkyW4lker device code phishing campaign, tricks victims into authorizing an attacker's sign-in instead of intercepting the session.) Here is how it works.

Step 1: The victim receives a phishing message

An employee gets an email with a link that appears to lead to a legitimate business service, often impersonating a document-sharing tool, a business notification, or a Microsoft 365 sign-in request. (Here is how to spot a phishing email.)

Step 2: The employee visits a fraudulent sign-in page

The malicious site looks like a real Microsoft login page. Instead of just collecting a password, the attacker's infrastructure sits between the employee and Microsoft's real authentication service, relaying the exchange in real time.

Step 3: The employee completes authentication

The employee enters their credentials and completes the MFA challenge. The attacker-controlled relay forwards that exchange to Microsoft. Because the employee is interacting with a convincing imitation of the normal login, they may not realize the session is being intercepted.

Step 4: The attacker captures a usable token

Once authentication succeeds, the attacker captures the token or session material that proves the user has authenticated, then replays it from their own separate infrastructure.

Step 5: The attacker accesses Microsoft 365

If the replay works, the attacker can reach services such as Exchange Online using the victim's authenticated identity, without necessarily triggering another MFA challenge. In the Huntress investigation, stolen sessions were replayed within minutes of the initial phishing.

Why MFA alone may not stop token replay

Multifactor authentication remains one of the most important defenses against account compromise, and it is far better than passwords alone. (If you have not turned it on yet, start with two-factor authentication for small business.) But not all MFA methods resist phishing equally.

In an AitM attack, the victim can complete a genuine MFA challenge while the attacker captures the authentication material that gets generated afterward. The attacker is not necessarily defeating the MFA mechanism itself; they are abusing a session that has already been authenticated. That distinction matters: the fix is not "turn off MFA," it is to add layers that make a stolen session harder to get and less useful. For Microsoft 365, phishing-resistant methods such as FIDO2 security keys and properly configured passkeys offer stronger protection against credential phishing. It is important to be precise about what they do, though: phishing-resistant MFA is specifically good at defeating adversary-in-the-middle phishing like the attack above, because there is no reusable code or prompt for the relay to capture. It does not make session theft impossible. If an employee's device is compromised (for example by an infostealer that steals browser cookies), or a token is captured by other means, an attacker can still end up with a usable session. In other words, phishing-resistant MFA closes one major door, but device security and session monitoring are still needed to cover the others.

What did attackers do after getting in?

The Huntress investigation found the attackers did far more than read email. They worked to establish persistent access and interfere with business communications.

• Registered unauthorized devices. At least 48 rogue devices were registered in affected Microsoft Entra environments, giving attackers another route to obtain tokens and keep access.
• Changed MFA methods. In at least 19 organizations, attackers removed existing MFA methods and registered their own replacements within three hours of initial access, so they could authenticate again even after the stolen session expired.
• Created hidden email rules. Using short or misleading names, attackers built inbox rules that targeted messages mentioning payroll, deposits, and bonuses, moving them into obscure folders or deleting them to conceal activity.
• Abused compromised mailboxes. In one case, a compromised account was used to send unwanted messages to hundreds of external recipients, putting customers and partners at risk through a trusted domain.

Why small businesses should pay attention

Microsoft 365 is the backbone of communication and collaboration for many small and medium businesses, so a single compromised account can cause real damage:

• Business email compromise. Attackers impersonate employees, request fraudulent payments, or message trusted contacts. (See how a stolen login becomes invoice fraud.)
• Exposure of sensitive information. Depending on permissions, attackers may reach emails, attachments, and other cloud resources.
• Unauthorized account changes. Attackers modify authentication settings, register devices, or add new ways back in.
• Operational disruption. A hijacked inbox can interrupt customer communication and demand lengthy investigation and recovery.

For organizations without a dedicated security team, these incidents are hard to spot and contain quickly, which is exactly why a clear response plan matters.

How to protect your Microsoft 365 accounts from token replay

Use several layers of identity security rather than passwords and MFA alone.

• Use phishing-resistant MFA. Where supported, prioritize FIDO2 security keys, passkeys, or Windows Hello for Business, which help prevent the credential-interception that AitM phishing relies on.
• Configure Microsoft Entra Conditional Access. Depending on your licensing, consider requiring compliant or trusted devices, enforcing authentication strength, restricting risky authentication flows, and applying sign-in risk controls. Test policies carefully so you do not lock out legitimate work.
• Monitor suspicious sign-ins. Review Microsoft Entra sign-in logs for unfamiliar IP addresses, unexpected locations, unusual devices, and repeated failed attempts. One unfamiliar IP is not proof of compromise, but unusual patterns deserve a look.
• Audit registered devices. Investigate any device employees do not recognize, especially ones registered during suspicious sign-in activity.
• Review MFA registration changes. Unapproved additions or replacements of authentication methods after a suspicious sign-in are a strong sign an attacker is trying to keep access.
• Inspect mailbox rules. Look for rules that auto-delete messages, hide financial emails, or forward mail to unexpected destinations.
• Train employees on phishing. Encourage people to verify unexpected sign-in requests and document-sharing invitations, and to avoid entering credentials through links in emails. Awareness training complements technical controls; it does not replace them.

What to do if your Microsoft 365 account is compromised

If you suspect an attacker has stolen a session, move quickly and in order. This mirrors the detailed playbook in our Microsoft 365 compromise response guide.

• Contain the account. Use admin controls to restrict the affected account while you investigate.
• Revoke active sessions. Revoke the user's sign-in sessions in Microsoft Entra ID and invalidate refresh tokens. Be aware revocation may not instantly kill every previously issued access token; token lifetimes and app behavior affect how quickly access ends.
• Reset the password from a trusted administrative environment, and do not assume the reset alone removes all attacker access.
• Remove unauthorized authentication methods. Review registered MFA methods and delete any added without authorization.
• Investigate suspicious devices and apps. Check Entra device registrations and enterprise application (OAuth) consent for unauthorized changes.
• Inspect the mailbox. Review inbox rules, forwarding, sent items, deleted items, and audit records to see whether sensitive communications were accessed or external parties contacted.
• Investigate the original compromise. Determine whether it started with phishing, device-code abuse, or malware. If the employee's device is infected, secure it before restoring normal access.
• Keep monitoring, and if business data was accessed or disclosed, evaluate your notification and reporting obligations.

For the account-level version of this, applicable to any exposed login, see what to do when an employee's work credentials are exposed.

Can stolen credentials and session tokens be found on the dark web?

Yes, and no. Cybercriminals do distribute stolen credentials and session-related data through criminal marketplaces and underground channels, and infostealer malware harvests saved passwords, browser cookies, and other sensitive data from infected devices. But not every stolen session token ends up in a searchable breach database: some are captured directly through phishing infrastructure and used within minutes, never publicly distributed.

That is why credential exposure monitoring and Microsoft 365 security monitoring serve different, complementary purposes. Credential monitoring helps surface known exposed accounts and passwords, while identity and endpoint controls help detect and respond to suspicious sessions and active account takeover.

How GuardPilot helps

For a small business, a security incident mostly creates questions: Was an employee's password exposed? Which accounts need attention? What happens next? GuardPilot is the AI Incident Response Platform for Credential Exposure: it helps businesses and individuals find credential exposure and gives guided, plain-English steps for responding to exposed accounts. When an employee's credentials turn up in breach or infostealer data, GuardPilot explains what was exposed, how serious it is, and walks you through remediation, then reminds you until it is resolved.

To be precise about the boundary: GuardPilot does not replace Microsoft Entra monitoring, token revocation, endpoint investigation, or Microsoft 365 incident response, and it is not a session-token detection tool. It complements those controls by focusing on credential exposure awareness and guided remediation, the part that is easy for a small team to miss. If you are worried your business credentials may already be exposed, you can start free and see what is out there in about a minute.

Worried your business credentials have been exposed? Check for known credential exposure with GuardPilot and get clear steps to protect affected accounts. Check your credential exposure.

Frequently asked questions

Can hackers access Microsoft 365 without knowing my password?

Yes. Attackers may be able to access Microsoft 365 using a stolen, valid authentication token or session. The exact outcome depends on the token, your security policies, and other protections.

Can token replay attacks bypass MFA?

A stolen authenticated session may let an attacker reach resources without completing another MFA challenge. That does not mean all MFA methods are equally vulnerable; phishing-resistant methods raise the bar considerably.

Does changing my Microsoft 365 password stop a token replay attack?

Not necessarily. A password reset should be combined with session revocation, review of authentication methods, removal of unauthorized devices, and the rest of the response steps above.

How can I tell if someone has hijacked my Microsoft 365 account?

Warning signs include suspicious sign-ins, unfamiliar registered devices, unexpected MFA changes, hidden mailbox rules, and unusual sent messages.

Can GuardPilot detect stolen Microsoft 365 session tokens?

No. GuardPilot focuses on credential exposure monitoring and guided response. It should not be treated as a Microsoft 365 session-token detection or revocation solution; use Microsoft Entra and your identity controls for that.

Sources and further reading

• Huntress: M365 token spray and replay campaign compromises business email accounts (primary source).
• The Hacker News: Microsoft 365 token-replay attacks compromise 97 accounts at 79 organizations.
• Microsoft Digital Defense Report: token replay and identity security.

The takeaway

The Microsoft 365 token replay campaign reported by Huntress marks a shift in how account takeovers happen. Attackers do not always need to guess passwords or defeat MFA challenges; sometimes stealing and reusing an authenticated session is enough. A secure password is only the beginning. Businesses must also protect authenticated sessions, monitor identity activity, and respond quickly when suspicious access occurs. As token replay attacks become a growing concern, strong identity security and credential exposure awareness are essential parts of protecting Microsoft 365 environments.