Ten-week Microsoft 365 email intrusion hits 79 organizations, 497 sign-ins

En bref

• Unknown actor targeted Microsoft 365 and an email service across 79 organizations.
• 497 authentications succeeded while roughly 200,000 attempts failed between July 14 and September 22, 2026.
• Attackers replayed stolen sessions and hid mailbox rules to maintain access to mail.
• No CVE was assigned; Microsoft, Huntress, and 1337 Services GmbH are named vendors.
• Severity is medium; mailbox-rule audits and session revocation are immediate priorities.

An unknown attacker conducted a ten-week campaign from July 14 to September 22, 2026, targeting Microsoft 365 and an email service and affecting 79 distinct organizations. Telemetry cited in the case shows 497 authentications that succeeded alongside approximately 200,000 attempts that failed. Microsoft, Huntress, and 1337 Services GmbH are named as vendors in the incident details, and no CVE was assigned.

The intrusion pattern centered on replaying stolen session material, generating authentication attempts, and creating mailbox rules designed to stay out of sight. That combination matters because session replay can bypass some password-only defenses, while concealed rules give an attacker a quiet foothold inside mailboxes even after initial access is disrupted.

The impact is compromised accounts, access to mail, and concealed inbox rules that can persist unnoticed. For a K-12 environment, mailbox access can expose student and staff communications, vendor conversations, and password-reset traffic. The medium severity reflects the absence of a software vulnerability CVE, but account takeover and persistent mail access remain serious operational risks.

What to watch: clusters of failed authentications followed by a success, unusual session activity, and mailbox rules that forward, hide, or delete messages. Administrators should treat the July-to-September window as a review period, prioritize affected accounts, and verify that no lingering rules or active sessions remain. The large failure count is also a useful detection signal when paired with even a small number of successful authentications.

À faire maintenant

1. Revoke active sessions and refresh tokens for any account tied to the incident, then force reauthentication.
2. Audit mailbox rules for forwarding, hiding, deletion, or unusual folder moves and remove anything unexplained.
3. Review sign-in logs for July 14 through September 22, 2026, prioritizing the 497 successful authentications and failure bursts.
4. Reset credentials for affected accounts and require MFA enrollment or re-enrollment where policy allows.
5. Enforce conditional access, block legacy authentication, and alert on anomalous token replay or session reuse.
6. Check OAuth application grants and mailbox delegation for persistence mechanisms beyond inbox rules.
7. Report confirmed compromises to Microsoft and Huntress support channels and preserve logs for investigation.

Source originale

Help Net Security