Microsoft 365 accounts compromised at 79 organizations, no passwords needed
MentionsMicrosoftMicrosoft 365
An attacker who spent ten weeks replaying stolen Microsoft 365 sign-in sessions broke into email accounts at 79 organizations and used hidden inbox rules to keep victims from seeing parts of their own mail, according to Huntress. The researchers tracked the campaign between July 14 and September 22, 2026, counting 497 successful sign-ins and more than 200,000 failed login attempts.
Summary from Help Net Security.
Related coverage
Other sources covering the same vulnerabilities or event.