Security firm Huntress said it tracked a Microsoft 365 attack campaign from July 14 to September 22, 2026. It responded to related incidents at 79 organizations. It counted at least 497 successful sign-ins and more than 200,000 failed attempts. The attackers did not guess passwords. Huntress said they used fake login relays to copy the token Microsoft issues after multifactor authentication (MFA). They then reused those tokens from servers at German host 1337 Services GmbH.
Huntress said the attackers registered at least 48 fake computers in victims' Microsoft directories. In 19 organizations, they wiped the victim's MFA methods and added their own within three hours. They also created inbox rules to hide replies. In at least one case, they sent a payroll-related email to an outside contact. Huntress said it cannot say for certain why the attackers kept switching addresses. The report does not name who is behind the campaign. It gives no total for how many payroll emails were sent.
Huntress said a stolen token lets its holder skip MFA, because Microsoft issues it after MFA is done. It said properly set Conditional Access policies, which are rules for who may sign in, can prevent this. For a suspected case, it advises revoking sessions and resetting the password, then removing rogue devices and MFA methods. A password reset alone leaves those in place.