As of October 26, 2026, a Microsoft 365 token theft campaign is stealing sign-in sessions, replaying them, and then adding its own MFA method so a password reset won't lock the attacker out. Huntress tied 497 successful sign-ins at 79 organizations to one campaign. If you run Microsoft 365 for a Battle Creek or Kalamazoo business, you can check for the signs yourself this week. Here's what I'd look at.
What is Microsoft 365 token replay?
Token replay is when an attacker reuses a stolen sign-in session instead of guessing your password. When you sign in, Microsoft hands your browser a token that says you already passed MFA. If an attacker captures that token, they don't need your password or your code. Huntress, a security company, described the campaign as running from July 14 to September 22, 2026, with more than 200,000 failed attempts alongside the 497 successful sign-ins (Huntress).
How do attackers steal the token?
Often through a fake sign-in page that relays everything to the real Microsoft page. You type your password and approve MFA, and the attacker keeps the session that comes back. Huntress also saw device-code phishing and social engineering during a legitimate sign-in as sources of tokens, per the same report. The Hacker News ran a summary of the same report on October 26 (The Hacker News).
Why doesn't a password reset fix it?
Because the attacker adds their own way back in. Huntress reports that in at least 19 organizations, existing MFA methods were removed and a new one registered within three hours of the first sign-in. It also found at least 48 rogue devices registered in Entra, Microsoft's identity system, per the same Huntress report. A reset alone leaves the stolen token usable for roughly 90 minutes and leaves those devices and MFA methods in place, per the same report. That's the part I'd want every owner to know: changing the password feels like the fix, and here it isn't.
What did the attackers do once inside?
They hid. Huntress found inbox rules that move or delete mail, given short, forgettable names such as a single period or "sss," and rules that send mail to folders like RSS Feeds. In one case, the attacker sent a payroll-related email from a hijacked mailbox to an outside accountant, per Huntress. For a small shop, payroll and invoice mail is exactly what an attacker wants to redirect. Mail sent from a hijacked mailbox comes from your real account, so it passes the SPF, DKIM and DMARC checks that stop outsiders from spoofing your domain. Your customer or your accountant gets no warning sign.
What should I check in my tenant this week?
Here are the five things I'd do. If you have an IT provider, ask them for each one by name.
- Review MFA methods. In the Entra admin center, look at each user's authentication methods. Remove any authenticator the person doesn't recognize. Huntress saw one labeled "iPhone 13."
- Review registered devices. Look for names like DESKTOP- plus eight uppercase hex characters, registered from an unfamiliar location. Huntress notes the pattern isn't unique to this campaign, so confirm before deleting.
- Check inbox rules. Look for rules with very short or meaningless names, or ones that move mail to RSS Feeds or Conversation History.
- Revoke sessions, then reset the password. Do both for anyone you suspect. A reset by itself isn't enough.
- Look at Conditional Access. Huntress recommends requiring MFA for all users, all cloud apps and all client app types, and restricting the device-code sign-in flow (Huntress).
Does MFA still matter?
Yes. MFA still stops the common password-guessing attack, and Huntress's advice is to enforce it everywhere. What this campaign shows me is that MFA alone isn't the finish line. You also need to watch for changes to MFA and devices after someone signs in. If you can't tell who in your company has added a new authenticator this month, that's the gap I'd close first.
Who can help me check?
Start with your own IT provider and hand them the five items above. If you don't have one, I can look at your email setup, and my Microsoft 365 vs Google Workspace guide explains what each platform covers. I'll tell you straight what I find, and what I can't see from outside.