Microsoft 365 Security Breach: 79 Organizations Affected by Stolen Session Tokens

Post Views: 6

79 organizations’ Microsoft 365 accounts were compromised through stolen session tokens in a cyber operation spanning ten weeks.

Cyber Operation Overview

The cyber operation targeted Microsoft 365 accounts at 79 organizations, exploiting stolen session tokens rather than traditional password theft. The campaign, which occurred from July 14 to September 22, 2026, utilized stolen session tokens to circumvent password requirements and multi-factor authentication, resulting in 497 successful logins and over 200,000 failed attempts.

Attack Methodology

Researchers identified internet protocol addresses linked to German hosting provider 1337 Services GmbH, while Microsoft Entra ID Protection flagged multiple nodes as anomalous during the attack. Adversaries employed a combination of phishing tactics, device-code deception, and social engineering to intercept authentication data during standard sign-in processes.

Phishing and Token Theft

Fraudulent websites mimicked Microsoft’s verification pages, capturing session tokens immediately after users completed multi-factor authentication challenges. Once obtained, attackers deployed a technique called token spraying, reusing credentials across multiple targets to bypass security mechanisms.

Exploitation of Short-Lived Sessions

The breach exploited short-lived session windows, with attackers gaining access from suspicious servers within 12 minutes of verification on July 21 and four minutes on September 22. The operation utilized six IP addresses within the 193.26.115.0/24 subnet across four phases, rendering single-address blacklisting ineffective due to the rotating infrastructure.

Impact and Tactics

To sustain access beyond the expiration of stolen tokens, attackers deployed rogue hardware and manipulated authentication protocols. Network defenses were further compromised at 19 organizations, where legitimate authentication methods were systematically disabled.

Email System Compromise

Once inside email systems, adversaries created covert routing rules using subtle identifiers such as periods or short alphanumeric strings to mask their activities. These configurations deleted incoming messages, marked communications as read, or redirected sensitive data to obscure folders like RSS Feeds and Conversation History.

Automated Token Reuse

In one case, attackers used a compromised mailbox to issue payroll instructions to an external accountant, followed by automated filters to obscure replies and terms related to banking, direct deposits, or bonuses. The automated reuse of stolen tokens intensified on September 11, generating hundreds of successful logins across nearly 30 entities before encountering resistance.

Mitigation and Recommendations

A single campaign IP address recorded 1,052 automated rejections across four organizations with active Conditional Access policies blocking unauthorized access. Security experts emphasized that mitigating token-based threats requires enforcing strict conditional access rules, terminating active sessions, removing unrecognized hardware, and auditing email configurations alongside traditional password management.

Security experts emphasized that mitigating token-based threats requires enforcing strict conditional access rules, terminating active sessions, removing unrecognized hardware, and auditing email configurations alongside traditional password management.