# Stolen Session Tokens Compromise Microsoft 365 Accounts Across 79 Organizations

*Published October 26, 2026*
*Source: [https://www.news4hackers.com/microsoft-365-security-breach-79-organizations-affected-by-stolen-session-tokens/](https://www.news4hackers.com/microsoft-365-security-breach-79-organizations-affected-by-stolen-session-tokens/)*

## Executive Summary

*This is a Premium edition. The Executive Summary is available to sec-news.ai members —*
*[read it here](https://www.sec-news.ai/news/stolen-session-tokens-compromise-microsoft-365-accounts-across-79-organizations) or [see plans](https://www.sec-news.ai/pricing).*

## Article

A sophisticated cyber operation compromised Microsoft 365 accounts in 79 organizations by exploiting stolen session tokens, rather than relying on traditional password theft. This campaign, active from July 14 to September 22, 2026, circumvented both password requirements and multi-factor authentication, leading to 497 successful unauthorized logins and over 200,000 failed attempts. The attackers utilized IP addresses linked to the German hosting provider 1337 Services GmbH. Microsoft Entra ID Protection identified multiple nodes as suspicious during the attack. 

To execute their plan, adversaries used a blend of phishing tactics, device-code deception, and social engineering to capture authentication data during normal sign-in processes. They set up fraudulent websites that mimicked Microsoft's verification pages, capturing session tokens right after users completed multi-factor authentication challenges. With these tokens, attackers employed a technique known as token spraying, reusing credentials across various targets to bypass security measures. 

The campaign exploited short-lived session windows, with attackers accessing systems from suspicious servers in mere minutes after verification. They utilized six IP addresses within the 193.26.115.0/24 subnet, rotating infrastructure to avoid detection. To maintain prolonged access, attackers deployed rogue hardware and manipulated authentication protocols, compromising network defenses at 19 organizations by disabling legitimate authentication methods. 

Once inside email systems, adversaries created covert routing rules using subtle identifiers to mask their activities. They deleted incoming messages, marked communications as read, or redirected sensitive data to obscure folders. In one instance, attackers used a compromised mailbox to issue fraudulent payroll instructions, then obscured replies and terms related to banking and bonuses. The automated reuse of stolen tokens intensified on September 11, resulting in hundreds of successful logins across nearly 30 entities before encountering resistance. 

Experts highlight the importance of enforcing strict conditional access rules, terminating active sessions, removing unrecognized hardware, and auditing email configurations to mitigate token-based threats effectively.