Stolen Session Tokens Used to Open Microsoft 365 Mailboxes at 79 Organizations
Stolen Microsoft 365 session tokens replayed at 79 organizations; 497 successful sign-ins and hidden inbox rules. Steps to revoke sessions and audit rules.
- Between July 14 and September 22, 2026, attackers accessed Microsoft 365 mailboxes at 79 organizations by replaying stolen session tokens instead of using passwords.
- The campaign produced 497 successful authentications, and attackers planted hidden inbox rules in victim mailboxes.
- Impact is unauthorized mailbox access plus concealment of messages; IT teams should revoke sessions and audit inbox rules now.
What to do now
- Revoke active sessions and refresh tokens for any account you suspect, then require reauthentication (Entra ID: revoke sessions / invalidate refresh tokens).
- Audit every mailbox rule for forwarding, redirect, delete, move-to-folder or mark-as-read actions; remove anything users cannot explain.
- Pull sign-in logs for July 14 – September 22, 2026 and look for token-based or session-cookie sign-ins, unusual IPs/ASNs, and the 497-success pattern described in the reporting.
- Reduce token theft exposure: enforce conditional access, block legacy authentication, shorten token lifetimes, and enable token protection / compliant-device requirements where licensed.
- Check OAuth application consent grants and mailbox delegation (FullAccess, SendAs, SendOnBehalf) for persistence that outlives a password reset.
Related items
- Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
- Microsoft: Windows Server 2016 reaches end of support in January
- Microsoft 365 accounts compromised at 79 organizations, no passwords needed
- HPE patches eight max severity RCE and auth bypass AOS flaws
- Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)