Microsoft 365 token replay attacks: why MFA didn't stop them
Huntress has detailed a campaign that stole Microsoft 365 sign-in sessions after users passed MFA. Here is what the attackers did and what to check in your own tenant.
Your staff can have multi-factor authentication switched on and still lose their Microsoft 365 mailbox. That is the message of new research from security firm Huntress, reported in late October 2026. It describes a campaign that ran from July 14 to September 22, in which attackers stole the sign-in session itself rather than the password.
What happened
In its write-up, Huntress says it responded to related incidents at 79 organizations. The Hacker News reports the totals as 97 compromised accounts, 497 successful sign-ins out of more than 200,000 attempts, and at least 48 fake computers registered in victims' Microsoft directories.
The method works like this. A fake sign-in page sits between the user and the real Microsoft page. The user types their password and approves the MFA prompt as normal, and Microsoft issues a session token, which is the proof that this login is finished. The relay captures that token, and the attacker replays it from their own machine. Huntress also traced tokens to device-code phishing and to social engineering during a genuine login. Huntress calls the large-scale replay "token spraying", after password spraying.
Why it matters for a small business
What the attackers did next is the useful part. Once inside, they worked to stay in, even if the stolen session expired:
- They replaced MFA. In at least 19 organizations, the victim's MFA methods were removed and a new one was added within three hours of the first sign-in.
- They registered rogue devices. A registered device can stay in your directory until someone deletes it.
- They hid mail. Inbox rules with names as short as "s" or "." deleted or moved messages mentioning payroll, deposit or bonus.
Those rules point at a familiar goal: quietly changing where money goes while the real employee doesn't see the replies. A password reset on its own doesn't remove any of this.
What to check this week
- Look at inbox rules. Check for rules with odd names, or rules that delete mail or move it to folders like RSS Feeds and Conversation History, starting with whoever handles payroll and invoices.
- Review MFA methods. In the Microsoft Entra admin center, look for authenticator apps or phone numbers nobody recognizes, especially any added within minutes of old ones being removed.
- Audit registered devices. Huntress noted fake machines named "DESKTOP-" plus eight characters. Delete anything you can't match to a real computer.
- If you find something, do it all together. Revoke the user's sessions, reset the password, remove the rogue methods, devices and rules, then check what was sent from the mailbox.
What to change
MFA still blocks plenty of attacks, so keep it on. To close this gap, look at phishing-resistant sign-in such as passkeys or hardware security keys, which won't work on a fake site. If your Microsoft 365 plan includes Conditional Access, use it to limit sign-ins to trusted devices and to block the device-code flow for people who don't need it. Tell staff to confirm by phone any request to change bank details, using a number you already have, and to report an unexpected sign-in prompt even if they approved it.
For more on the human side, see our phishing and email security page and our advice on password and account security.
If you'd like someone to look through your Microsoft 365 sign-ins, rules and devices, call (213) 986-4855 or read about our cybersecurity services.