Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

If you sign in to Microsoft 365 at work, your password is no longer the only thing standing between your inbox and an intruder. Attackers are stealing the digital proof of login that your device receives after you have already cleared the extra security check, then replaying it from their own machines. Attackers compromised 97 Microsoft 365 accounts across 79 organizations this way, The Hacker News reported on October 26, 2026. The underlying research comes from Huntress , published October 22, 2026, which tracked the campaign over ten weeks, from July 14 to September 22, 2026. The scale is worth sitting with: more than 200,000 failed login attempts produced 497 successful sign-ins across the affected organizations. None of it depended on guessed passwords.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.