97 Microsoft 365 Accounts Breached: The Token Trick Behind It

Emily Davis · 2026-10-26

Picture this: someone has your password, and you never even get a warning. That's basically what's happening in a Microsoft 365 campaign that's been quietly hitting organizations across the board. No phishing email with a typo. No suspicious attachment. Just a stolen sign-in session that keeps working long after the victim thinks they're safe. Security researchers at Huntress have been tracking this thing, and what they found is a little unsettling. Between July 14 and September 22, 2026, they logged 497 successful Microsoft 365 sign-in events tied to the campaign. Those events led to 97 compromised accounts spread across 79 organizations. That's not a small blip. That's a pattern. ### So What Exactly Is a Token-Replay Attack? Here's the thing most people don't realize. When you sign into Microsoft 365, you're not just typing a password. You're getting a token, a little digital pass that says "yep, this person is verified." It's what keeps you logged in so you don't have to retype your credentials every five minutes. The attackers in this campaign used what's called an adversary-in-the-middle relay. Think of it like a fake receptionist standing between you and the real front desk. You hand over your credentials thinking you're talking to Microsoft. The relay grabs your session token, then replays it to actually break in. No password cracking required. The token does all the work. That's why this attack is sneaky. By the time anyone notices, the intruder is already inside the email account, reading messages and doing whatever else they came for. ### Why This Should Matter to You Email is the front door to almost everything. Password resets, invoices, client conversations, internal docs. If someone gets into your inbox, they can pivot to just about anything else. > "A stolen token is like a copied house key. The lock still works fine, you just don't know someone else has a copy." And here's the part that should make you pause. Traditional defenses focus on passwords. They check if you typed the right one. But if the token is valid, the system sees nothing wrong. It's a legitimate-looking session doing illegitimate things. ### What You Can Actually Do About It You don't need to panic, but you do need to be a little more careful. A few practical moves: - Turn on conditional access policies that tie tokens to specific devices or locations. A token from an unexpected country is a red flag. - Shorten session lifetimes where you can. Fewer hours means fewer chances to replay a stolen token. - Watch for unusual sign-in patterns. A sudden spike in sessions from a single region is worth a look. - Train your team to spot fake login pages. AiTM relays live and die by tricking people into entering credentials on a lookalike site. - Review third-party access regularly. Every connected app is another door. ### The Bigger Picture This campaign isn't some rare, exotic thing. It's a reminder that identity is the new perimeter. Attackers aren't knocking down walls anymore. They're walking in through the front door with a copied key and a smile. For organizations running Microsoft 365, the takeaway is simple. Passwords alone aren't enough. You need layered defenses that look at behavior, not just credentials. And you need to assume that a stolen token isn't a matter of if, but when. Stay sharp out there. The quiet attacks are always the ones worth watching.