Skip to content
securitytabs

LiveUpdated

Stolen Microsoft 365 sign-in sessions used to break into email at 79 organizations

An attacker reused stolen Microsoft 365 sign-in sessions to get into company email accounts without needing passwords, according to security firm Huntress. Organizations that use Microsoft 365 have no emergency patch to install, since this is an attack method rather than a software flaw.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

Huntress says an attacker spent about ten weeks replaying stolen Microsoft 365 sign-in sessions to break into email accounts at 79 organizations, according to Help Net Security. A replayed session lets an attacker act as the signed-in user without entering a password. Help Net Security says the stolen sessions were replayed from servers at a hosting provider named 1337 Services GmbH. [1]

The Hacker News reports the campaign used an adversary-in-the-middle relay, a system that sits between a victim and the real sign-in page, to capture sessions before replaying the stolen tokens. It counts 97 compromised accounts across the 79 organizations. Infosecurity Magazine links the activity to a Microsoft 365 business email compromise campaign that uses phishing, stolen session tokens and social engineering. [2][3]

Scale and activity

Huntress observed the activity between July 14 and September 22, 2026. It counted 497 successful Microsoft 365 sign-ins and more than 200,000 failed login attempts, according to Help Net Security. Help Net Security adds that the attacker used hidden inbox rules to keep victims from seeing parts of their own mail. [1][2]

What is not yet known

The articles reviewed do not name the attacker, say how many victims lost money, or list specific fixes from Microsoft. Infosecurity Magazine describes the activity as widespread token spraying but its summary gives no further detail. [3][1]

Timeline

  1. The Hacker News reported 97 compromised accounts and an adversary-in-the-middle relay. [2]

  2. Help Net Security and Infosecurity Magazine reported the campaign against 79 organizations. [1][3]

  3. The activity tracked by Huntress ended. [1]

  4. Huntress began counting the Microsoft 365 session-replay activity. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Stolen sign-in sessions can give an attacker access to email without a password, and the reporting names no patch. No specific mitigations were published in the articles reviewed. [1][2]

What to do

  1. Ask your IT provider or MSP whether anyone has checked your Microsoft 365 accounts for unfamiliar inbox rules that hide or move mail. [1]
  2. Ask your provider whether sign-in activity has been reviewed for logins from hosting providers, since Huntress says the replayed sessions came from servers at one. [1]

Mid-size company

A small IT or security team

What to know

Huntress reports sessions were captured and replayed, so a password reset alone may not describe the whole problem. The sources give no vendor fix. [1][2]

What to do

  1. Review Microsoft 365 mailboxes for hidden or unexpected inbox rules, which Huntress says the attacker used. [1]
  2. Review sign-in logs for successful logins from hosting-provider infrastructure, including 1337 Services GmbH, and for runs of failed attempts. [1][2]

Large enterprise

A security operations team

What to know

Huntress describes a ten-week campaign using an adversary-in-the-middle relay and token replay, with 497 successful sign-ins and more than 200,000 failed attempts. No indicators beyond the hosting provider have been quoted in the articles reviewed. [1][2]

What to do

  1. Hunt in Microsoft 365 sign-in and mailbox audit logs for replayed sessions and for inbox rules that hide messages. [1]
  2. Check sign-in records for traffic from servers at 1337 Services GmbH, and review Huntress's report for further indicators. [1][2]
  3. Review whether business email compromise response procedures cover session theft as well as password theft. [3][2]

Sources

  1. [1]Help Net Security · Oct 23, 11:45 UTC
    Microsoft 365 accounts compromised at 79 organizations, no passwords neededcontext
  2. [2]The Hacker News · Oct 26, 08:35 UTC
    Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizationscontext
  3. [3]Infosecurity Magazine · Oct 23, 10:30 UTC
    Widespread Token-Spraying Attacks Target Microsoft 365 Accounts For Email Compromisecontext