Yes. Someone can get into your Microsoft 365 account without knowing your password, and without being stopped by your MFA prompt either. If you’ve been told that a strong password plus MFA makes you safe, this is the gap in that advice.
It matters right now because a campaign using exactly this method was just written up. I’ll walk through what happened, how to check whether you’re exposed, and what to change this week.
What happened
Security firm Huntress tracked an attacker who spent about ten weeks, from July 14 to September 22, 2026, replaying stolen Microsoft 365 sign-in sessions. According to Help Net Security’s summary, the attacker got into email accounts at 79 organizations. Huntress counted 497 successful sign-ins and more than 200,000 failed attempts.
The researchers said the accounts were compromised “without the attacker ever needing a password.”
Here’s the trick, in plain English. When you sign in to Microsoft 365 and pass the MFA prompt, Microsoft hands your browser a session token. Think of it as a wristband at a venue. Once you’re wearing it, nobody asks for your ticket again.
The attackers stole the wristband. Victims landed on a fake sign-in page that sat in the middle and passed everything through to the real Microsoft login, including the MFA prompt. The victim signed in normally. The fake page quietly kept the token Microsoft issued at the end. Because that token is created after MFA, whoever holds it doesn’t have to pass MFA again.
Two other routes were used too:
- Device-code phishing. The victim is tricked into typing a code onto Microsoft’s real sign-in page.
- Social engineering during an ordinary login. The source doesn’t give details, but the point is that not every case involved a fake page.
Speed is part of the problem. In one July 21 incident, the hijacked session showed up from the attacker’s server 12 minutes after the victim reached the MFA prompt. On September 22 the gap was four minutes.
What the attacker did once inside
This is the part I’d want every business owner to read, because it’s what makes a clean-up harder than a password reset.
- Fake devices. Huntress found at least 48 rogue computers registered in victims’ Microsoft Entra directories. Each was named “DESKTOP-” followed by eight letters and numbers. A registered device stays there until someone deletes it.
- Swapped MFA. In 19 organizations, the victim’s existing MFA methods were wiped and a new one added within three hours. In the July 21 case, an authenticator app labelled “iPhone 13” was activated less than an hour after the hijack. That lets the attacker pass MFA on future sign-ins, and it survives a password reset unless someone audits the account and removes it.
- Hidden mail. Inbox rules with throwaway names like “.”, “sss” and “iT” deleted incoming mail, or marked it read and moved it into folders like RSS Feeds and Conversation History.
In one case, the attacker used a hijacked mailbox to send a payroll-related email to an external accountant. They edited a rule to catch any message mentioning payroll, direct deposit, bank or bonus. Five minutes later they made a second rule that hid all mail from the accountant. The owner couldn’t see the replies.
What I see in the sign-in logs
One detail from the research lines up with how we work. The attacker moved between six addresses in one block over four phases, with breaks of a week or two. Huntress said blocking any one address would have stopped a single phase at most. Blocking IPs one at a time is a losing game.
How to tell if this affects you
If you or your staff use Microsoft 365 email, you’re in the group that could be targeted. The campaign hit organizations, not only big ones, and it relied on people signing in normally on a convincing fake page.
The questions that matter:
- Does anyone on your team sign in by clicking a link in an email or message?
- Has anyone ever entered a code on a Microsoft page because someone else told them to?
- Does anyone manage your Microsoft 365 settings, or did you set it up once and leave it alone?
- Do you have any rules in place that block or challenge unusual sign-ins, or do you rely on passwords plus MFA alone?
That last one is where the campaign was won or lost. On September 11, the attacker switched to a new address and ran an automated tool that reused captured tokens. It completed hundreds of successful sign-ins at nearly 30 organizations over four days. That same address was blocked 1,052 times, and every block came from four organizations whose Conditional Access policies refused the sign-ins.
What to do today
- Ask about Conditional Access. These are rules in Microsoft 365 that decide who gets in and under what conditions. They can require MFA or block access outright. Huntress says they can fill some of the gaps MFA leaves. If you have an IT provider, ask them whether any are set up and what they do. If you manage it yourself, this is the setting to look into first.
- Look at the token-protection options.
- Never enter a code you didn’t ask for. If someone sends you a code to type onto a Microsoft page, stop. Real sign-ins don’t work that way.
- Check inbox rules. Open your mailbox settings and read through every rule. Delete anything you didn’t create, especially odd names or rules that delete mail or move it to strange folders.
- Check your MFA methods. Look at the list of sign-in methods on your account. If you see an authenticator you don’t recognize, like a phone model you don’t own, remove it.
- Check registered devices. If you have admin access, look in Entra for devices named “DESKTOP-” followed by eight random characters that you can’t match to a real computer.
Signs something already went wrong
- Replies you expected never arrived, or a client says they answered and you never saw it.
- Mail is marked read that you never opened, or sitting in folders you don’t use.
- Inbox rules you didn’t make, with names like “.”, “sss” or “iT”.
- An MFA method or device on your account that isn’t yours.
- Your accountant or bank got a payroll or payment email you don’t remember sending.
- Microsoft shows sign-in activity you don’t recognize.
If you find any of these, don’t stop at changing your password. As the research makes clear, a rogue authenticator can survive a reset. The account needs a proper audit: rules, MFA methods and devices.
When to get help
Get help if you find any of the signs above, if money or payroll details may have been exposed, or if you can’t say whether Conditional Access is configured on your account. An audit of sign-ins, rules, devices and MFA methods is quick for someone who does it daily, and it’s a bad thing to guess at.
Need help with this?
I’m a SOC analyst and I help small businesses with exactly this kind of problem. Book a free call and I’ll tell you honestly whether you need help or just a couple of settings changed.