Attackers bypass MFA at 79 organizations using session token replay

Attackers breached Microsoft 365 accounts at 79 organizations between July and September 2026 by replaying stolen session tokens to bypass multi-factor authentication (MFA) ^[3].

Threat actors can circumvent MFA by capturing tokens issued after the authentication process is complete. This shift toward identity-based attacks aligns with a trend where identity systems—cloud-based identity and access management services used for securing user authentication and resource access ^[1]—are primary targets for ransomware operators.

Token replay breaches 79 organizations

Between July 14 and September 22, 2026, an attacker compromised email accounts at 79 organizations using stolen sign-in sessions ^[3]. Researchers from Huntress documented 497 successful sign-ins and over 200,000 failed login attempts ^[3].

The attacker used adversary-in-the-middle (AiTM) relays to capture session tokens ^[3]. These relays pass genuine Microsoft login pages and MFA prompts to the victim; once the victim completes the process, the relay captures the resulting session token ^[3]. Because the token is issued after MFA verification, the attacker can access the account without a password or further MFA ^[3].

Attackers also obtained tokens through social engineering during ordinary logins and via device-code phishing, where victims entered codes on legitimate Microsoft sign-in pages ^[3]. Huntress researchers noted, "The Microsoft accounts were compromised without the attacker ever needing a password" ^[3].

Campaign infrastructure and persistence

The attacker used servers from 1337 Services GmbH, a Hamburg-based hosting provider ^[3]. The researchers termed the bulk replay of stolen sessions "token spraying," describing it as the same pattern as password spraying but using tokens instead of guessed passwords ^[3].

Activity was highly time-sensitive. On July 21, a hijacked session appeared from a 1337 Services address 12 minutes after the victim reached the MFA prompt; by September 22, that gap dropped to four minutes ^[3]. The attacker cycled through six addresses in the 193.26.115.0/24 range across four phases ^[3].

To maintain access after sessions expired, the attacker registered at least 48 rogue computers in Microsoft Entra directories ^[3]. These devices were named “DESKTOP-” followed by eight hexadecimal characters ^[3]. In 19 organizations, the attacker deleted existing MFA methods and registered a new one within three hours of the initial sign-in ^[3].

In one instance, an authenticator app labeled “iPhone 13” was activated less than an hour after the session was hijacked ^[3]. This allows attackers to complete MFA for new sign-ins at will, a state that persists after a password reset ^[3].

Inside accounts, the attacker used hidden inbox rules named “.”, “sss” and “iT” to delete or move mail to folders like Conversation History and RSS Feeds ^[3]. In one case, the attacker targeted payroll emails containing "bonus," "bank," "direct deposit," or "payroll," and hid all mail from the victim's external accountant ^[3].

Identity systems as ransomware targets

The Semperis 2026 Ransomware Risk Report surveyed 1,200 IT and security professionals across nine countries and eight industry sectors ^[5]. The report found that 87% of ransomware cases involved targeting or exploiting identity systems ^[5]. All surveyed organizations had experienced at least one successful ransomware attack that disrupted operations ^[5].

Entra ID was targeted in 48% of attacks, Active Directory in 51%, and Okta in 27% ^[5]. These categories overlap ^[5]. Tomer Bar, a security research executive at Semperis, warned that "attackers with suitable permissions can use Active Directory to move between machines and encrypt systems" ^[5].

Recovery gaps persist: only 50% of surveyed organizations maintained dedicated identity backups, and 42% used automated identity recovery solutions ^[5]. Documented recovery procedures existed for Active Directory at 60%, Entra ID at 52%, and Okta at 28% ^[5].

Among surveyed victims, 69% suffered multiple successful ransomware attacks within a single year ^[5]. Forty percent of respondents reported AI-based attacks, while 44% reported attacks exploiting their own AI agents or systems ^[5].

Microsoft guidance on service accounts

Microsoft provides guidance on creating service accounts in Entra ID that are exempt from MFA ^[1].

These exemptions are for non-interactive purposes, such as automated services that cannot respond to MFA prompts ^[1]. This is necessary because current Conditional Access (CA) policies and mandatory MFA enforcement typically prompt for credentials and MFA when accessing SSO-integrated applications ^[1].

What we don't know

• What specific security controls failed at the 79 organizations to allow the AiTM relays to succeed?
• How many of the 79 organizations detected the rogue devices registered in their directories?
• What specific "AI-based attacks" are described in the Semperis report?