Attackers breach 97 Microsoft 365 accounts, Huntress says
Administrators are advised to revoke sessions and inspect devices, authentication methods and inbox rules following breaches at 79 organisations.
Loading… Բեռնվում է…
Administrators are advised to revoke sessions and inspect devices, authentication methods and inbox rules following breaches at 79 organisations.
Attackers compromised 97 Microsoft 365 accounts at 79 organisations during a campaign observed between July 14 and September 22, 2026, security researchers at Huntress said. The findings, published by The Hacker News on October 26, describe attackers reusing stolen sign-in sessions, then adding devices and authentication methods to maintain access.
Huntress counted 497 successful sign-in events, not 497 compromised accounts. A single account can produce multiple sign-ins; the researchers identified 97 accounts as compromised.
| Measure | Count |
|---|---|
| Login attempts | More than 200,000 |
| Successful sign-in events | 497 |
| Compromised accounts | 97 |
| Affected organisations | 79 |
| Rogue Entra devices registered | 48 |
Multi-factor authentication, or MFA, asks users for another form of verification in addition to a password. In the attack described, a fake login page sat between the victim and Microsoft’s real sign-in service. It passed the victim’s credentials and MFA codes to Microsoft while capturing the token issued after authentication—a digital proof that the user had signed in.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
The attackers then reused that token from their own devices within minutes. This is token replay: using proof of an already authenticated session rather than completing MFA again for that session. The described method does not mean the campaign defeated every form of MFA.
After gaining access, attackers added their own authenticator apps so they could complete MFA challenges on later sign-ins, Huntress said. In at least 19 organisations, victims' existing MFA methods were removed and a new method registered within three hours of the first sign-in. Those changes gave attackers a way to sign in after a stolen session token expired or was revoked.
The 48 rogue Entra devices were fake computers registered in the organisations' Microsoft directories. Huntress said a registered device could provide a more durable way to request tokens than a stolen session alone and would remain in the directory until someone deleted it.
Attackers also created hidden inbox rules that deleted messages containing payroll-, deposit- or bonus-related keywords, or moved them into folders such as RSS Feeds and Conversation History. In one compromised mailbox, a rule marked every incoming message as read and deleted it; that mailbox was then used to send spam to hundreds of external recipients.
For organisations that suspect a compromise, the published recommendations are to revoke active sign-in sessions and reset passwords, then audit Entra devices, review MFA methods and inspect inbox rules and newly added enterprise applications. These checks address the additional access methods and mailbox changes described in the campaign.
The advice also calls for restricting the device-code sign-in workflow through Conditional Access policies—rules that control the conditions under which users and devices can access services. Huntress said appropriately implemented policies can address some security gaps that MFA alone cannot.
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min